CVE catalog

CVE-2022-1706

ignition: CVE-2022-1706

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.30% · Oct 25, 2026

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianignitionsid2.14.0+ds1-1fixed
Debianignitionforky2.14.0+ds1-1fixed
Debianignitiontrixie2.14.0+ds1-1fixed
Debianignitionbookworm2.14.0+ds1-1fixed
Suseignitionlinux enterprise micro 5.22.14.0-150300.6.7.1fixed
Opensuseignitionleap micro 5.22.14.0-150300.6.7.1fixed
Susesystemd-presets-common-SUSElinux enterprise module for basesystem 15 sp315-150100.8.17.1fixed
Susesystemd-presets-common-SUSElinux enterprise module for basesystem 15 sp415-150100.8.17.1fixed
Susesystemd-presets-common-SUSElinux enterprise micro 5.115-150100.8.17.1fixed
Susesystemd-presets-common-SUSElinux enterprise micro 5.215-150100.8.17.1fixed
Opensusesystemd-presets-common-SUSEleap 15.315-150100.8.17.1fixed
Opensusesystemd-presets-common-SUSEleap 15.415-150100.8.17.1fixed
Opensusesystemd-presets-common-SUSEleap micro 5.215-150100.8.17.1fixed
Suseignitionlinux enterprise micro 5.12.14.0-150300.4.7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianignitionsourcesid2.14.0+ds1-1not yet assignedNot reported[1014716]
Debianignitionsourceforky2.14.0+ds1-1not yet assignedNot reported[1014716]
Debianignitionsourcetrixie2.14.0+ds1-1not yet assignedNot reported[1014716]
Debianignitionsourcebookworm2.14.0+ds1-1not yet assignedNot reported[1014716]
Suseignitionrpmlinux enterprise micro 5.22.14.0-150300.6.7.1Not reportedSUSE-SU-2022:2349-1Not reported
Opensuseignitionrpmleap micro 5.22.14.0-150300.6.7.1Not reportedSUSE-SU-2022:2349-2Not reported
Susesystemd-presets-common-SUSErpmlinux enterprise module for basesystem 15 sp315-150100.8.17.1Not reportedSUSE-SU-2022:2866-1Not reported
Susesystemd-presets-common-SUSErpmlinux enterprise module for basesystem 15 sp415-150100.8.17.1Not reportedSUSE-SU-2022:2866-1Not reported
Susesystemd-presets-common-SUSErpmlinux enterprise micro 5.115-150100.8.17.1Not reportedSUSE-SU-2022:2866-1Not reported
Susesystemd-presets-common-SUSErpmlinux enterprise micro 5.215-150100.8.17.1Not reportedSUSE-SU-2022:2866-1Not reported
Opensusesystemd-presets-common-SUSErpmleap 15.315-150100.8.17.1Not reportedSUSE-SU-2022:2866-1Not reported
Opensusesystemd-presets-common-SUSErpmleap 15.415-150100.8.17.1Not reportedSUSE-SU-2022:2866-1Not reported
Opensusesystemd-presets-common-SUSErpmleap micro 5.215-150100.8.17.1Not reportedSUSE-SU-2022:2866-2Not reported
Suseignitionrpmlinux enterprise micro 5.12.14.0-150300.4.7.1Not reportedSUSE-SU-2022:2350-1Not reported

[Debian bug #1014716]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ignition]Fixed

    Source package: [ignition]

    Details (2)

    • 2.14.0+ds1-1+b6 · amd64 · bookworm

      Fixed · Fixed: 2.14.0+ds1-1

      dsa · ignition · debian · bookworm

    • 2.14.0+ds1-1+b6 · arm64 · bookworm

      Fixed · Fixed: 2.14.0+ds1-1

      dsa · ignition · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]