~ / search / GHSA-f4w6-3rh6-6q4q

GHSA-f4w6-3rh6-6q4q

Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-11255

Packages

EcosystemPackageAffectedFixed in
Go github.com/kubernetes-csi/external-provisioner < 0.4.3 0.4.3
Go github.com/kubernetes-csi/external-provisioner >= 1.0.0, < 1.0.2 1.0.2
Go github.com/kubernetes-csi/external-provisioner 1.1 no fix listed
Go github.com/kubernetes-csi/external-provisioner >= 1.2.0, < 1.2.2 1.2.2
Go github.com/kubernetes-csi/external-provisioner >= 1.3.0, < 1.3.1 1.3.1
Go github.com/kubernetes-csi/external-snapshotter/v6 >= 1.0.0, < 1.0.2 1.0.2
Go github.com/kubernetes-csi/external-snapshotter/v6 1.1 no fix listed
Go github.com/kubernetes-csi/external-snapshotter/v6 >= 1.2.0, < 1.2.2 1.2.2
Go github.com/kubernetes-csi/external-resizer 0.1 no fix listed
Go github.com/kubernetes-csi/external-resizer 0.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

References

External links from the advisory. They lead to third-party sites.