CVE-2022-29179

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-29179
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29179.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-29179
Aliases
Related
Published
2022-05-20T18:30:12Z
Modified
2026-05-13T04:08:01.347786362Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Improper Privilege Management in Cilium
Details

Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can escalate privileges to cluster admin by using Cilium's Kubernetes service account. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. There are no known workarounds available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29179.json",
    "cwe_ids": [
        "CWE-269"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
27e0848cc52f13cd697eec7c6cada84667c47879
Fixed
b0d3140aa079b31d2f3889b0f695cf7add393e68

Affected versions

1.*
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
v1.*
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29179.json"