CVE-2023-38495

Description

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

How to fix CVE-2023-38495

To remediate CVE-2023-38495, upgrade the affected package to a fixed version below.

• —upgrade to 1.11.5 or later
• —upgrade to 1.11.5 or later
• —upgrade to 1.11.5 or later

Is CVE-2023-38495 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 1.11.5, >= 1.12.0, < 1.12.3
• from 0, < 1.11.5
• from 0, < 1.11.5, >= 1.12.0, < 1.12.3

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-38495
• PATCHgithub.com/crossplane/crossplane
• WEBgithub.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf
• WEBgithub.com/crossplane/crossplane/security/advisories/GHSA-pj4x-2xr5-w87m