Skip to content
Fencer Intel
medium 6.6

CVE-2022-3294 json

Node address isn't always verified when proxying

published 3y ago modified 4mo ago also GHSA-jh36-q97c-9928 , GO-2023-1629 , EUVD-2023-1049

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.

Patch / fix

  • go github.com/kubernetes/kubernetes 1.22.16, 1.23.14, 1.24.8, 1.25.4
  • go k8s.io/kubernetes 1.22.16, 1.23.14, 1.24.8, 1.25.4
  • kubernetes kubernetes 1.22.16, 1.23.14, 1.24.8, 1.25.4
  • kubernetes Debian 14, Debian 13, Debian 12 1.20.5+really1.20.2-1

debian advisories DEBIAN-CVE-2022-3294

  • microshift openshift 4.12 4.12.1-202301261525.p0.g3db9e81.assembly.4.12.1.el8

red hat advisories RHBA-2023:0452

  • kubernetes1.23 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Containers 15 SP4 +3 more 1.23.17-150300.7.6.1

suse advisories SUSE-SU-2023:2292-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1
  • kubernetes1.25 openSUSE Tumbleweed 1.25.7-1.1

opensuse advisories openSUSE-SU-2025:15424-1openSUSE-SU-2024:12810-1

Is CVE-2022-3294 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3294 updated cvss 8.8

kubernetes: node address isn't always verified when proxying

  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.12 microshift 4.12.1-202301261525.p0.g3db9e81.assembly.4.12.1.el8
    fixed: vendor fix RHBA-2023:0452
  • Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift4/ose-tests, openshift-kube-apiserver, +3 more Red Hat OpenShift Container Platform 4.12 microshift-selinux 4.12.1-202301261525.p0.g3db9e81.assembly.4.12.1.el8, microshift-networking 4.12.1-202301261525.p0.g3db9e81.assembly.4.12.1.el8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 6.6

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/kubernetes/kubernetes
>=1.25.0, <1.25.4
>=1.24.0, <1.24.8
>=1.23.0, <1.23.14
>=1.22.0, <1.22.16
1.25.4
1.24.8
1.23.14
1.22.16
go k8s.io/kubernetes
>=1.22.0, <1.22.16
>=1.23.0, <1.23.14
>=1.24.0, <1.24.8
>=1.25.0, <1.25.4
1.22.16
1.23.14
1.24.8
1.25.4

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.