by Kastro
Paper/Archive/CVE-2023-38495

CVE-2023-38495

crossplane crossplane — Crossplane vulnerable to possible image tampering from missing image validation for Packages

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.7.577 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

Affected

ProductAffectedFixed inSource
crossplane< 1.11.5–CNA
crossplane>= 1.12.0, < 1.12.3–CNA
crossplane< 1.11.51.11.5CISA-ADP
crossplane1.12.0 – < 1.12.31.12.3CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.4CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/crossplane/crossplane/security/advisories/GHSA-pj4x-2xr5-w87mrefgithub.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf