CVE-2019-11255

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

CVSS v3 4.8 MEDIUM
CVSS v2.0 5.5 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://access.redhat.com/errata/RHSA-2019:4054	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4096	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4099	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4225	Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/85233	Mitigation Third Party Advisory
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw
https://security.netapp.com/advisory/ntap-20200810-0003/
https://access.redhat.com/errata/RHSA-2019:4054	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4096	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4099	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4225	Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/85233	Mitigation Third Party Advisory
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw
https://security.netapp.com/advisory/ntap-20200810-0003/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:kubernetes:external-provisioner::::::::
	cpe:2.3:a:kubernetes:external-provisioner::::::::
	cpe:2.3:a:kubernetes:external-provisioner::::::::
	cpe:2.3:a:kubernetes:external-provisioner:1.3.0:::::::*
	cpe:2.3:a:kubernetes:external-resizer::::::::
	cpe:2.3:a:kubernetes:external-snapshotter::::::::
	cpe:2.3:a:kubernetes:external-snapshotter::::::::
	cpe:2.3:a:kubernetes:external-snapshotter::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.1:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.2:::::::*

History

21 Nov 2024, 04:20

Type	Values Removed	Values Added
CVSS	v2 : ~~5.5~~ v3 : ~~6.5~~	v2 : 5.5 v3 : 4.8
References	~~() https://access.redhat.com/errata/RHSA-2019:4054 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2019:4054 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2019:4096 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2019:4096 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2019:4099 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2019:4099 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2019:4225 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2019:4225 - Third Party Advisory
References	~~() https://github.com/kubernetes/kubernetes/issues/85233 - Mitigation, Third Party Advisory~~	() https://github.com/kubernetes/kubernetes/issues/85233 - Mitigation, Third Party Advisory
References	~~() https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw -~~	() https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw -
References	~~() https://security.netapp.com/advisory/ntap-20200810-0003/ -~~	() https://security.netapp.com/advisory/ntap-20200810-0003/ -

Information

Published : 2019-12-05 16:15

Updated : 2024-11-21 04:20

NVD link : CVE-2019-11255

Mitre link : CVE-2019-11255

CVE.ORG link : CVE-2019-11255

JSON object : View

Products Affected

redhat

openshift_container_platform

kubernetes

external-snapshotter
external-resizer
external-provisioner

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-11255", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "jordan@liggitt.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "published": "2019-12-05T16:15:10.567", "references": [{"url": "https://access.redhat.com/errata/RHSA-2019:4054", "tags": ["Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4096", "tags": ["Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4099", "tags": ["Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4225", "tags": ["Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://github.com/kubernetes/kubernetes/issues/85233", "tags": ["Mitigation", "Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw", "source": "jordan@liggitt.net"}, {"url": "https://security.netapp.com/advisory/ntap-20200810-0003/", "source": "jordan@liggitt.net"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4054", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4096", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4099", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4225", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/kubernetes/kubernetes/issues/85233", "tags": ["Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20200810-0003/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "jordan@liggitt.net", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations."}, {"lang": "es", "value": "Una comprobaci\u00f3n de entrada inapropiada en contenedores sidecar de Kubernetes CSI para external-provisioner (versiones anteriores a v0.4.3, versiones anteriores a v1.0.2, v1.1, versiones anteriores a v1.2.2, versiones anteriores a v1.3.1), external-snapshotter (versiones anteriores a v0.4.2, versiones anteriores a v1. 0.2, v1.1, versiones anteriores a 1.2.2) y external-resizer (versiones v0.1, v0.2), podr\u00edan resultar en el acceso no autorizado a los datos PersistentVolume o la mutaci\u00f3n del volumen durante una imagen instant\u00e1nea, una restauraci\u00f3n desde una imagen instant\u00e1nea, la clonaci\u00f3n y el cambio de tama\u00f1o."}], "lastModified": "2024-11-21T04:20:48.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A78A50B-5286-400D-A54A-49F1023D97D6", "versionEndIncluding": "0.4.2", "versionStartIncluding": "0.4.1"}, {"criteria": "cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5CDEBDE-A093-4D75-A289-7F8D8F47C163", "versionEndIncluding": "1.0.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CD30FBE-792A-42E3-9FAA-3122EBBEFC4C", "versionEndIncluding": "1.2.1", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:kubernetes:external-provisioner:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "686C1D64-DB77-451E-A3EC-9A415F7EAA2B"}, {"criteria": "cpe:2.3:a:kubernetes:external-resizer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "920BC20F-8C59-4A34-AA0C-EBFD469C59C3", "versionEndIncluding": "0.2.0", "versionStartIncluding": "0.1.0"}, {"criteria": "cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2DDFBDD-3AA1-40E4-B349-90D40C6E70F9", "versionEndIncluding": "0.4.1", "versionStartIncluding": "0.4.0"}, {"criteria": "cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F14DDAA3-4DD3-43D9-B934-4856C9A6B138", "versionEndIncluding": "1.0.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0279E824-AF71-4EA1-8F41-3FAF256DC6EC", "versionEndIncluding": "1.2.1", "versionStartIncluding": "1.1.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F87326E-0B56-4356-A889-73D026DB1D4B"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "064E7BDD-4EF0-4A0D-A38D-8C75BAFEDCEF"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C85A84D-A70F-4B02-9E5D-CD9660ABF048"}], "operator": "OR"}]}], "sourceIdentifier": "jordan@liggitt.net"}

4.8 /10

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.5 /10

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2019-11255

4.8^/10

5.5^/10

Attach tags to `CVE-2019-11255`