CVE-2023-38495highCWE-20

CVE-2023-38495: high-severity vulnerability in crossplane

Crossplane vulnerable to possible image tampering from missing image validation for Packages

Published · Updated

Follow this CVE+ Monitor crossplane+ Monitor github.com/crossplane/crossplane

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 0.8%
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
crossplane · crossplane
Related CVEs — crossplane

In the same product, most dangerous first.

CVE-2023-27484MEDIUMUnchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplaneEPSS 0.7%CVE-2023-37900LOWCrossplane vulnerable to denial of service from large imageEPSS 0.6%