CVE-2022-38368: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Aviatrix Gateway before versions 6.6.5712 and 6.7.x before 6.7.1376. The vulnerability allowed authenticated VPN users to potentially inject arbitrary commands due to Gateway API functions mishandling authentication (Aviatrix Docs, NVD).

The vulnerability stems from Gateway API functions that contained improper authentication mechanisms, which could be exploited by authenticated VPN users. The issue was rated as High severity for Gateways (Aviatrix Docs).

A successful exploitation of this vulnerability would allow an authenticated VPN user to execute arbitrary commands against Aviatrix gateways (Aviatrix Docs).

The vulnerability requires authentication as a VPN user to exploit. No public exploits were known at the time of disclosure (Aviatrix Docs).

The vulnerability was addressed in Aviatrix Gateway versions 6.6.5712 and later, and 6.7.1376 and later. Users are recommended to upgrade their Aviatrix Controller and gateway software to these versions or newer (Aviatrix Docs).

Aviatrix acknowledged Thomas Wallin from Splunk for the responsible disclosure of this issue (Aviatrix Docs).