Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 1.8%
probabilidad de explotación
1.8%top 24% de las CVE
explotación observada
noninguna fuente lo reporta
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
Productos afectados
Kubernetes · kubernetes-csi external-provisionerKubernetes · kubernetes-csi external-resizerKubernetes · kubernetes-csi external-snapshotterReferencias
https://access.redhat.com/errata/RHSA-2019:4054https://access.redhat.com/errata/RHSA-2019:4096https://access.redhat.com/errata/RHSA-2019:4099https://access.redhat.com/errata/RHSA-2019:4225https://github.com/kubernetes/kubernetes/issues/85233https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIwhttps://security.netapp.com/advisory/ntap-20200810-0003/