CVE-2023-38495

Crossplane vulnerable to possible image tampering from missing image validation for Packages

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

Affected

crossplane

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

8.3 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.84% chance of exploitation in the next 30 days, 57th percentile

Published

2023-07-27

Updated

2024-10-10

Proof-of-concept exploits (1)

• crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security…12148★ · 2026-10-13

Security advisories

• crossplane/crossplane/security/advisories/GHSA-pj4x-2xr5-w87m
• advisories/GHSA-pj4x-2xr5-w87m

References

• CVE Record
• NVD entry