Medium severity · published Dec 5, 2019
CVE-2019-11255
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1,…
6.5
CVSS
2%
EPSS
No
On KEV
Description
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
External-provisioner · Kubernetes
0.4.1 through 0.4.2; 1.0.0 through 1.0.1; 1.1.0 through 1.2.1; 1.3.0 · source: NVD
EX
External-resizer · Kubernetes
0.1.0 through 0.2.0 · source: NVD
EX
External-snapshotter · Kubernetes
0.4.0 through 0.4.1; 1.0.0 through 1.0.1; 1.1.0 through 1.2.1 · source: NVD
OC
Openshift Container Platform · Redhat
3.11; 4.1; 4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11255
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4054
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4096
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4099
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4225
Mitigation
https://github.com/kubernetes/kubernetes/issues/85233
groups.google.com
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw