Search
Find a vulnerability
Search criteria
2 vulnerabilities found for kubernetes-csi external-snapshotter by Kubernetes
CVE-2019-11255 (GCVE-0-2019-11255)
Vulnerability from nvd – Published: 2019-12-05 16:05 – Updated: 2024-09-16 23:05
VLAI
EPSS
VEX
Title
Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
Summary
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
Severity
4.8 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/kubernetes/kubernetes/issues/85233 | x_refsource_CONFIRM |
| https://groups.google.com/forum/#%21topic/kuberne… | mailing-listx_refsource_MLIST |
| https://access.redhat.com/errata/RHSA-2019:4099 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4096 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4054 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4225 | vendor-advisoryx_refsource_REDHAT |
| https://security.netapp.com/advisory/ntap-2020081… | x_refsource_CONFIRM |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Kubernetes | kubernetes-csi external-provisioner |
Affected:
prior to 1.0.2
Affected: 1.1 Affected: prior to 1.2.2 Affected: prior to 1.3.1 Affected: v1.14 , < prior to 0.4.3 (custom) |
|
| Kubernetes | kubernetes-csi external-snapshotter |
Affected:
prior to 0.4.2
Affected: prior to 1.0.2 Affected: 1.1 Affected: prior to 1.2.2 |
|
| Kubernetes | kubernetes-csi external-resizer |
Affected:
0.1
Affected: 0.2 |
Date Public
2019-11-14 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:48:08.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/kubernetes/kubernetes/issues/85233"
},
{
"name": "Security release of kubernetes-csi sidecars - CVE-2019-11255",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw"
},
{
"name": "RHSA-2019:4099",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4099"
},
{
"name": "RHSA-2019:4096",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4096"
},
{
"name": "RHSA-2019:4054",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4054"
},
{
"name": "RHSA-2019:4225",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4225"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200810-0003/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "kubernetes-csi external-provisioner",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "prior to 1.0.2"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "prior to 1.2.2"
},
{
"status": "affected",
"version": "prior to 1.3.1"
},
{
"lessThan": "prior to 0.4.3",
"status": "affected",
"version": "v1.14",
"versionType": "custom"
}
]
},
{
"product": "kubernetes-csi external-snapshotter",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "prior to 0.4.2"
},
{
"status": "affected",
"version": "prior to 1.0.2"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "prior to 1.2.2"
}
]
},
{
"product": "kubernetes-csi external-resizer",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Xiangqian Yu"
}
],
"datePublic": "2019-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-10T11:06:07.000Z",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubernetes/kubernetes/issues/85233"
},
{
"name": "Security release of kubernetes-csi sidecars - CVE-2019-11255",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw"
},
{
"name": "RHSA-2019:4099",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4099"
},
{
"name": "RHSA-2019:4096",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4096"
},
{
"name": "RHSA-2019:4054",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4054"
},
{
"name": "RHSA-2019:4225",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4225"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200810-0003/"
}
],
"source": {
"defect": [
"https://github.com/kubernetes/kubernetes/issues/85233"
],
"discovery": "INTERNAL"
},
"title": "Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation",
"workarounds": [
{
"lang": "en",
"value": "Kubernetes feature gates can be disabled and RBAC permissions revoked from impacted CSI drivers, following instructions in https://github.com/kubernetes/kubernetes/issues/85233"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "2019-11-14",
"ID": "CVE-2019-11255",
"STATE": "PUBLIC",
"TITLE": "Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "kubernetes-csi external-provisioner",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "v1.14",
"version_value": "prior to 0.4.3"
},
{
"version_value": "prior to 1.0.2"
},
{
"version_value": "1.1"
},
{
"version_value": "prior to 1.2.2"
},
{
"version_value": "prior to 1.3.1"
}
]
}
},
{
"product_name": "kubernetes-csi external-snapshotter",
"version": {
"version_data": [
{
"version_value": "prior to 0.4.2"
},
{
"version_value": "prior to 1.0.2"
},
{
"version_value": "1.1"
},
{
"version_value": "prior to 1.2.2"
}
]
}
},
{
"product_name": "kubernetes-csi external-resizer",
"version": {
"version_data": [
{
"version_value": "0.1"
},
{
"version_value": "0.2"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Xiangqian Yu"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/kubernetes/kubernetes/issues/85233",
"refsource": "CONFIRM",
"url": "https://github.com/kubernetes/kubernetes/issues/85233"
},
{
"name": "Security release of kubernetes-csi sidecars - CVE-2019-11255",
"refsource": "MLIST",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw"
},
{
"name": "RHSA-2019:4099",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4099"
},
{
"name": "RHSA-2019:4096",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4096"
},
{
"name": "RHSA-2019:4054",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4054"
},
{
"name": "RHSA-2019:4225",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4225"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200810-0003/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200810-0003/"
}
]
},
"source": {
"defect": [
"https://github.com/kubernetes/kubernetes/issues/85233"
],
"discovery": "INTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Kubernetes feature gates can be disabled and RBAC permissions revoked from impacted CSI drivers, following instructions in https://github.com/kubernetes/kubernetes/issues/85233"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2019-11255",
"datePublished": "2019-12-05T16:05:18.735Z",
"dateReserved": "2019-04-17T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:05:20.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11255 (GCVE-0-2019-11255)
Vulnerability from cvelistv5 – Published: 2019-12-05 16:05 – Updated: 2024-09-16 23:05
VLAI
EPSS
VEX
Title
Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
Summary
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
Severity
4.8 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/kubernetes/kubernetes/issues/85233 | x_refsource_CONFIRM |
| https://groups.google.com/forum/#%21topic/kuberne… | mailing-listx_refsource_MLIST |
| https://access.redhat.com/errata/RHSA-2019:4099 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4096 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4054 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4225 | vendor-advisoryx_refsource_REDHAT |
| https://security.netapp.com/advisory/ntap-2020081… | x_refsource_CONFIRM |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Kubernetes | kubernetes-csi external-provisioner |
Affected:
prior to 1.0.2
Affected: 1.1 Affected: prior to 1.2.2 Affected: prior to 1.3.1 Affected: v1.14 , < prior to 0.4.3 (custom) |
|
| Kubernetes | kubernetes-csi external-snapshotter |
Affected:
prior to 0.4.2
Affected: prior to 1.0.2 Affected: 1.1 Affected: prior to 1.2.2 |
|
| Kubernetes | kubernetes-csi external-resizer |
Affected:
0.1
Affected: 0.2 |
Date Public
2019-11-14 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:48:08.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/kubernetes/kubernetes/issues/85233"
},
{
"name": "Security release of kubernetes-csi sidecars - CVE-2019-11255",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw"
},
{
"name": "RHSA-2019:4099",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4099"
},
{
"name": "RHSA-2019:4096",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4096"
},
{
"name": "RHSA-2019:4054",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4054"
},
{
"name": "RHSA-2019:4225",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4225"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200810-0003/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "kubernetes-csi external-provisioner",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "prior to 1.0.2"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "prior to 1.2.2"
},
{
"status": "affected",
"version": "prior to 1.3.1"
},
{
"lessThan": "prior to 0.4.3",
"status": "affected",
"version": "v1.14",
"versionType": "custom"
}
]
},
{
"product": "kubernetes-csi external-snapshotter",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "prior to 0.4.2"
},
{
"status": "affected",
"version": "prior to 1.0.2"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "prior to 1.2.2"
}
]
},
{
"product": "kubernetes-csi external-resizer",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Xiangqian Yu"
}
],
"datePublic": "2019-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-10T11:06:07.000Z",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubernetes/kubernetes/issues/85233"
},
{
"name": "Security release of kubernetes-csi sidecars - CVE-2019-11255",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw"
},
{
"name": "RHSA-2019:4099",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4099"
},
{
"name": "RHSA-2019:4096",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4096"
},
{
"name": "RHSA-2019:4054",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4054"
},
{
"name": "RHSA-2019:4225",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4225"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200810-0003/"
}
],
"source": {
"defect": [
"https://github.com/kubernetes/kubernetes/issues/85233"
],
"discovery": "INTERNAL"
},
"title": "Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation",
"workarounds": [
{
"lang": "en",
"value": "Kubernetes feature gates can be disabled and RBAC permissions revoked from impacted CSI drivers, following instructions in https://github.com/kubernetes/kubernetes/issues/85233"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "2019-11-14",
"ID": "CVE-2019-11255",
"STATE": "PUBLIC",
"TITLE": "Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "kubernetes-csi external-provisioner",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "v1.14",
"version_value": "prior to 0.4.3"
},
{
"version_value": "prior to 1.0.2"
},
{
"version_value": "1.1"
},
{
"version_value": "prior to 1.2.2"
},
{
"version_value": "prior to 1.3.1"
}
]
}
},
{
"product_name": "kubernetes-csi external-snapshotter",
"version": {
"version_data": [
{
"version_value": "prior to 0.4.2"
},
{
"version_value": "prior to 1.0.2"
},
{
"version_value": "1.1"
},
{
"version_value": "prior to 1.2.2"
}
]
}
},
{
"product_name": "kubernetes-csi external-resizer",
"version": {
"version_data": [
{
"version_value": "0.1"
},
{
"version_value": "0.2"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Xiangqian Yu"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/kubernetes/kubernetes/issues/85233",
"refsource": "CONFIRM",
"url": "https://github.com/kubernetes/kubernetes/issues/85233"
},
{
"name": "Security release of kubernetes-csi sidecars - CVE-2019-11255",
"refsource": "MLIST",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw"
},
{
"name": "RHSA-2019:4099",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4099"
},
{
"name": "RHSA-2019:4096",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4096"
},
{
"name": "RHSA-2019:4054",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4054"
},
{
"name": "RHSA-2019:4225",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4225"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200810-0003/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200810-0003/"
}
]
},
"source": {
"defect": [
"https://github.com/kubernetes/kubernetes/issues/85233"
],
"discovery": "INTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Kubernetes feature gates can be disabled and RBAC permissions revoked from impacted CSI drivers, following instructions in https://github.com/kubernetes/kubernetes/issues/85233"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2019-11255",
"datePublished": "2019-12-05T16:05:18.735Z",
"dateReserved": "2019-04-17T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:05:20.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}