CVE-2019-11255

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 5.5 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/kubernetes/kubernetes/issues/85233	Mitigation Third Party Advisory
https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw	Mailing List Mitigation Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4099	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4096	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4054	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4225	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200810-0003/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:kubernetes:external-provisioner::::::::
	cpe:2.3:a:kubernetes:external-provisioner::::::::
	cpe:2.3:a:kubernetes:external-provisioner::::::::
	cpe:2.3:a:kubernetes:external-provisioner:1.3.0:::::::*
	cpe:2.3:a:kubernetes:external-resizer::::::::
	cpe:2.3:a:kubernetes:external-snapshotter::::::::
	cpe:2.3:a:kubernetes:external-snapshotter::::::::
	cpe:2.3:a:kubernetes:external-snapshotter::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.1:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.2:::::::*

Information

Published : 2019-12-05 08:15

Updated : 2020-08-10 05:15

NVD link : CVE-2019-11255

Mitre link : CVE-2019-11255

JSON object : View

CWE

CWE-20

Improper Input Validation

Products Affected

kubernetes

external-resizer
external-snapshotter
external-provisioner

redhat

openshift_container_platform

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/kubernetes/kubernetes/issues/85233", "name": "https://github.com/kubernetes/kubernetes/issues/85233", "tags": ["Mitigation", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw", "name": "Security release of kubernetes-csi sidecars - CVE-2019-11255", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4099", "name": "RHSA-2019:4099", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4096", "name": "RHSA-2019:4096", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4054", "name": "RHSA-2019:4054", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2019:4225", "name": "RHSA-2019:4225", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://security.netapp.com/advisory/ntap-20200810-0003/", "name": "https://security.netapp.com/advisory/ntap-20200810-0003/", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-11255", "ASSIGNER": "security@kubernetes.io"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}}, "publishedDate": "2019-12-05T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.4.2", "versionStartIncluding": "0.4.1"}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0.1", "versionStartIncluding": "1.0.0"}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.2.1", "versionStartIncluding": "1.1.0"}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-provisioner:1.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-resizer:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.2.0", "versionStartIncluding": "0.1.0"}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.4.1", "versionStartIncluding": "0.4.0"}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0.1", "versionStartIncluding": "1.0.0"}, {"cpe23Uri": "cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.2.1", "versionStartIncluding": "1.1.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-08-10T12:15Z"}

6.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5 /10

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2019-11255

6.5^/10

5.5^/10

Attach tags to `CVE-2019-11255`