CVE-2019-11255
published 2019-12-05CVE-2019-11255: Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter…
PriorityP434medium6.5CVSS 3.1
AVNACLPRHUINSUCHIHAN
EPSS
2.01%
80.8th percentile
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | kubernetes-csi_external-provisioner | >= 0 < 0.4.3 | 0.4.3 |
| github.com | kubernetes-csi_external-provisioner | >= 1.0.0 < 1.0.2 | 1.0.2 |
| github.com | kubernetes-csi_external-provisioner | >= 1.2.0 < 1.2.2 | 1.2.2 |
| github.com | kubernetes-csi_external-provisioner | >= 1.3.0 < 1.3.1 | 1.3.1 |
| github.com | kubernetes-csi_external-snapshotter_v6 | >= 1.0.0 < 1.0.2 | 1.0.2 |
| github.com | kubernetes-csi_external-snapshotter_v6 | >= 1.2.0 < 1.2.2 | 1.2.2 |
| kubernetes | external-provisioner | — | — |
| kubernetes | external-provisioner | 0.4.1 – 0.4.2 | — |
| kubernetes | external-provisioner | 1.0.0 – 1.0.1 | — |
| kubernetes | external-provisioner | 1.1.0 – 1.2.1 | — |
| kubernetes | external-resizer | 0.1.0 – 0.2.0 | — |
| kubernetes | external-snapshotter | 0.4.0 – 0.4.1 | — |
| kubernetes | external-snapshotter | 1.0.0 – 1.0.1 | — |
| kubernetes | external-snapshotter | 1.1.0 – 1.2.1 | — |
| kubernetes | kubernetes-csi_external-provisioner | — | — |
| kubernetes | kubernetes-csi_external-provisioner | — | — |
| kubernetes | kubernetes-csi_external-provisioner | — | — |
| kubernetes | kubernetes-csi_external-provisioner | — | — |
| kubernetes | kubernetes-csi_external-provisioner | >= v1.14 < prior to 0.4.3 | prior to 0.4.3 |
| kubernetes | kubernetes-csi_external-resizer | — | — |
| kubernetes | kubernetes-csi_external-resizer | — | — |
| kubernetes | kubernetes-csi_external-snapshotter | — | — |
| kubernetes | kubernetes-csi_external-snapshotter | — | — |
| kubernetes | kubernetes-csi_external-snapshotter | — | — |
| kubernetes | kubernetes-csi_external-snapshotter | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
vendor_redhat·2019-11-15·CVSS 4.8
CVE-2019-11255 [MEDIUM] CWE-20 kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
Statement: OpenShift Container Storage Interface (CSI) is a Technology Preview (TP) feature in OpenShift Container Platform before version 4.2.
https://access.redhat.com/support/offerings/techpreview
Package: csi-provisioner (Red Hat OpenShift Container Platform 3.11) - Not affected
OSV
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
osv·2022-05-24
CVE-2019-11255 [MEDIUM] Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
GHSA
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
ghsa·2022-05-24
CVE-2019-11255 [MEDIUM] CWE-20 Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2019:4054https://access.redhat.com/errata/RHSA-2019:4096https://access.redhat.com/errata/RHSA-2019:4099https://access.redhat.com/errata/RHSA-2019:4225https://github.com/kubernetes/kubernetes/issues/85233https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIwhttps://security.netapp.com/advisory/ntap-20200810-0003/https://access.redhat.com/errata/RHSA-2019:4054https://access.redhat.com/errata/RHSA-2019:4096https://access.redhat.com/errata/RHSA-2019:4099https://access.redhat.com/errata/RHSA-2019:4225https://github.com/kubernetes/kubernetes/issues/85233https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIwhttps://security.netapp.com/advisory/ntap-20200810-0003/
2019-12-05
Published