CVE-2023-38495highCWE-20

CVE-2023-38495: fallo de gravedad alta en crossplane

Crossplane vulnerable to possible image tampering from missing image validation for Packages

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear crossplane+ Monitorear github.com/crossplane/crossplane

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.4epss 0.8%
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
crossplane · crossplane
CVEs relacionadas — crossplane

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-27484MEDIUMUnchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplaneEPSS 0.7%CVE-2023-37900LOWCrossplane vulnerable to denial of service from large imageEPSS 0.6%