High severityNVD Advisory· Published Oct 25, 2023· Updated Feb 13, 2025
Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
CVE-2022-4886
Description
Ingress-nginx path sanitization can be bypassed with log_format directive.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
k8s.io/ingress-nginxGo | < 1.8.0 | 1.8.0 |
Affected products
1- Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- github.com/advisories/GHSA-gvrm-w2f9-f77qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-4886ghsaADVISORY
- www.openwall.com/lists/oss-security/2023/10/25/5ghsaWEB
- github.com/kubernetes/ingress-nginx/issues/10570ghsaissue-trackingWEB
- groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLIghsamailing-listWEB
- security.netapp.com/advisory/ntap-20240307-0013ghsaWEB
- security.netapp.com/advisory/ntap-20240307-0013/mitre
News mentions
0No linked articles in our index yet.