Security Advisory

CVE-2023-38495

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-07-27 18:07:13

Last updated 2024-10-10 18:00:40

Assigner GitHub_M

State PUBLISHED

Description

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplanes image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

← Browse all CVEs View on cve.org ↗