Low severity · published Jul 27, 2023
CVE-2023-37900
Crossplane is a framework for building cloud native control planes without needing to write code
2.7
CVSS
0.6%
EPSS
No
On KEV
Description
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crossplane · Cncf
before 1.11.5; 1.12.0 before 1.12.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37900
Exploit
https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf
Third Party Advisory
https://github.com/crossplane/crossplane/security/advisories/GHSA-68p4-95xf-7gx8
More from Crossplane
9.8
CVE-2023-38495
Crossplane is a framework for building cloud native control planes without needing to write code
