CVE-2022-4886 - Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

HIGH

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Published Oct 25, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.55%

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
0	affected	<1.8.0

Ecosystem	Package	Introduced	Fixed
Go	k8s.io/ingress-nginx	0	1.8.0

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2023/10/25/5		Mailing ListThird Party Advisory
https://github.com/advisories/GHSA-gvrm-w2f9-f77q		Advisory
https://github.com/kubernetes/ingress-nginx/issues/10570		issue-trackingMitigationVendor Advisory
https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI		mailing-listMailing ListMitigation
https://nvd.nist.gov/vuln/detail/CVE-2022-4886
https://security.netapp.com/advisory/ntap-20240307-0013