CVE-2022-39272 – Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

https://notcve.org/view.php?id=CVE-2022-39272

21 Oct 2022 — Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be emp... • https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v • CWE-1284: Improper Validation of Specified Quantity in Input •