CVE-2023-38495 Crossplane vulnerable to possible image tampering from missing image validation for Packages
Attackers can tamper with Crossplane packages due to missing validation, potentially leading to code execution or security bypasses in cloud native control planes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-38495?
CVE-2023-38495 is a high-severity vulnerability in crossplane, published on 27 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.
Weakness: CWE-20
Which versions are affected by CVE-2023-38495?
6 open source packages ship an affected version, including github.com/crossplane/crossplane and crossplane. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/crossplane/crossplane Go | All versions | 1.11.5, 1.12.3 |
github.com/crossplane/crossplane Go | All versions | 1.11.5 |
github.com/crossplane/crossplane Go | All versions | 1.11.5 |
github.com/crossplane/crossplane Go | From 1.12.0 | 1.12.3 |
github.com/crossplane/crossplane Go | From 1.12.0 | 1.12.3 |
crossplane Bitnami | All versions | 1.11.5, 1.12.3 |
Products include Cncf Crossplane.
How do I fix CVE-2023-38495?
Upgrade github.com/crossplane/crossplane to a fixed version for your release line: 1.11.5 or 1.12.3.
Is CVE-2023-38495 being exploited?
There is no known exploitation of CVE-2023-38495 in the wild and no public exploit code.
Other vulnerabilities in crossplane
Sources
Also known as BIT-crossplane-2023-38495, GHSA-pj4x-2xr5-w87m, GO-2023-1980.