Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2019-11255

Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes kubernetes-csi external-provisioner

  • prior to 1.0.2affected
  • 1.1affected
  • prior to 1.2.2affected
  • prior to 1.3.1affected
  • v1.14 to < prior to 0.4.3affected

Kubernetes kubernetes-csi external-snapshotter

  • prior to 0.4.2affected
  • prior to 1.0.2affected
  • 1.1affected
  • prior to 1.2.2affected

Kubernetes kubernetes-csi external-resizer

  • 0.1affected
  • 0.2affected

References