CVE-2023-38495highCWE-20

CVE-2023-38495: falha de alta gravidade em crossplane

Crossplane vulnerable to possible image tampering from missing image validation for Packages

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar crossplane+ Monitorar github.com/crossplane/crossplane

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 0.8%
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
crossplane · crossplane
CVEs relacionadas — crossplane

No mesmo produto, das mais perigosas para as menos.

CVE-2023-27484MEDIUMUnchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplaneEPSS 0.7%CVE-2023-37900LOWCrossplane vulnerable to denial of service from large imageEPSS 0.6%