Skip to content
OpenAdvisories
High · 8.7 CVE-2022-1798 EUVD-2022-6544GHSA-cvx8-ppmc-78hmGHSA-qv98-3369-g364GO-2022-1000

Path Traversal vulnerability in Kubevirt

Published Sep 15, 2022 · Updated Apr 21, 2025 · Assigned by Google

Vendor: Google Product: Kubevirt Package: kubevirt Package: kubevirt.io/kubevirt Ecosystem: Azure Linux Ecosystem: Go

Description

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

Affected products

VendorProductAffectedFixed
Google Kubevirt unspecified – < 0.55.1, unspecified – < 0.56.0 0.55.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 kubevirt 0.54.0-150400.3.3.2 SUSE-SU-2022:3333-1
SLES 15 SP3 kubevirt 0.49.0-150300.8.13.1 SUSE-SU-2022:3321-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.4 kubevirt 0.54.0-150400.3.3.2 SUSE-SU-2022:3333-1
openSUSE Leap 15.3 kubevirt 0.49.0-150300.8.13.1 SUSE-SU-2022:3321-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) kubevirt 0.55.1-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go kubevirt.io/kubevirt >= 0.20.0, < 0.55.1 0.55.1 GHSA-qv98-3369-g364

Advisories 4

References