CVE-2022-4886

Description

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

How to fix CVE-2022-4886

To remediate CVE-2022-4886, upgrade the affected package to a fixed version below.

• Go/k8s.io/ingress-nginx—upgrade to 1.8.0 or later

Is CVE-2022-4886 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.8.0

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-4886
• PATCHgithub.com/kubernetes/ingress-nginx
• WEBgithub.com/kubernetes/ingress-nginx/issues/10570
• WEBgroups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI
• WEB