CVE-2022-1706

ignition: Ignition is a utility used to manipulate systems during the initramfs

CVE-2022-1706 is fixed in ignition on 1 platform, first by DEBIAN-CVE-2022-1706, released May 17, 2022. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.5
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0130
70th percentile

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration. The following packages have been upgraded to a later upstream version: ignition (2.14.0). (BZ#2090647) Security Fix(es): * ignition: configs are accessible from unprivileged containers in VMs running on VMware products (CVE-2022-1706) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Where it's fixed

ProductFixed inFixReleased
Linux
ignition · Debian 12.15 (bookworm) 2.14.0+ds1-1 DEBIAN-CVE-2022-1706 May 17, 2022
ignition · Debian 13.5 (trixie) 2.14.0+ds1-1 DEBIAN-CVE-2022-1706 May 17, 2022
ignition · Debian 14 2.14.0+ds1-1 DEBIAN-CVE-2022-1706 May 17, 2022
ignition · RHEL 9 0:2.14.0-1.el9 RHSA-2022:8126 Nov 15, 2022
ignition · almalinux 9 2.14.0-1.el9 ALSA-2022:8126 Nov 15, 2022
ignition · ol 9 0:2.14.0-1.el9 ELSA-2022-8126 Nov 22, 2022
ignition · rocky 9 0:2.14.0-1.el9 RLSA-2022:8126 Nov 15, 2022

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.