CVE-2023-37900

CVSS V2 None CVSS V3 None

Description

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.

Overview

CVE ID
CVE-2023-37900

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-07-27T15:50:54.954Z

Last Modified Date
2023-07-27T17:54:31.116Z

Weakness Enumerations

CWE	URL
CWE-400	http://cwe.mitre.org/data/definitions/400.html
CWE-770	http://cwe.mitre.org/data/definitions/770.html

References

Reference URL	Reference Tags
https://github.com/crossplane/crossplane/security/advisories/GHSA-68p4-95xf-7gx8	x_refsource_CONFIRM
https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-37900
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37900

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 01:09:42				Added to TrackCVE