What is the severity of CVE-2023-27483?

CVE-2023-27483 has been classified as a security vulnerability that can lead to an out of memory panic.

How do I fix CVE-2023-27483?

To fix CVE-2023-27483, update the Crossplane runtime to a version that is not affected, such as versions 0.19.2 and above or not using 0.16.0.

Which versions of Crossplane are affected by CVE-2023-27483?

CVE-2023-27483 affects Crossplane runtime versions between 0.19.0 and 0.19.2, as well as version 0.16.0.

What is the impact of CVE-2023-27483 on applications?

Applications using the 'Paved' type's 'SetValue' method with user-provided input are at risk of experiencing an out of memory panic due to CVE-2023-27483.

How can I identify if my application is vulnerable to CVE-2023-27483?

To determine if your application is vulnerable to CVE-2023-27483, check if it uses the affected versions of the Crossplane runtime and the 'Paved' type's 'SetValue' method with untrusted input.

Vulnerability/
CVE-2023-27483

high

7.5

CWE

400 20

9/3/2023

2/8/2024

CVE-2023-27483: fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

First published: Thu Mar 09 2023(Updated: )

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's `SetValue` method with user provided input without proper validation might use excessive amounts of memory and cause an out of memory panic. In the fieldpath package, the Paved.SetValue method sets a value on the Paved object according to the provided path, without any validation. This allows setting values in slices at any provided index, which grows the target array up to the requested index, the index is currently capped at max uint32 (4294967295) given how indexes are parsed, but that is still an unnecessarily large value. If callers are not validating paths' indexes on their own, which most probably are not going to do, given that the input is parsed directly in the SetValue method, this could allow users to consume arbitrary amounts of memory. Applications that do not use the `Paved` type's `SetValue` method are not affected. This issue has been addressed in versions 0.16.1 and 0.19.2. Users are advised to upgrade. Users unable to upgrade can parse and validate the path before passing it to the `SetValue` method of the `Paved` type, constraining the index size as deemed appropriate.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Crossplane	>=0.19.0<0.19.2
Crossplane	=0.16.0

Remedy

https://github.com/crossplane/crossplane-runtime/commit/53508a9f4374604db140dd8ab2fa52276441e738

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2023-27483?
CVE-2023-27483 has been classified as a security vulnerability that can lead to an out of memory panic.
How do I fix CVE-2023-27483?
To fix CVE-2023-27483, update the Crossplane runtime to a version that is not affected, such as versions 0.19.2 and above or not using 0.16.0.
Which versions of Crossplane are affected by CVE-2023-27483?
CVE-2023-27483 affects Crossplane runtime versions between 0.19.0 and 0.19.2, as well as version 0.16.0.
What is the impact of CVE-2023-27483 on applications?
Applications using the 'Paved' type's 'SetValue' method with user-provided input are at risk of experiencing an out of memory panic due to CVE-2023-27483.
How can I identify if my application is vulnerable to CVE-2023-27483?
To determine if your application is vulnerable to CVE-2023-27483, check if it uses the affected versions of the Crossplane runtime and the 'Paved' type's 'SetValue' method with untrusted input.

agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/remedy
agent/severity
agent/last-modified-date
agent/title
agent/weakness
agent/author
agent/description
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/crossplane
canonical/crossplane
version/crossplane/0.19.0
version/crossplane/0.16.0

Frequently Asked Questions

What is the severity of CVE-2023-27483?
CVE-2023-27483 has been classified as a security vulnerability that can lead to an out of memory panic.
How do I fix CVE-2023-27483?
To fix CVE-2023-27483, update the Crossplane runtime to a version that is not affected, such as versions 0.19.2 and above or not using 0.16.0.
Which versions of Crossplane are affected by CVE-2023-27483?
CVE-2023-27483 affects Crossplane runtime versions between 0.19.0 and 0.19.2, as well as version 0.16.0.
What is the impact of CVE-2023-27483 on applications?
Applications using the 'Paved' type's 'SetValue' method with user-provided input are at risk of experiencing an out of memory panic due to CVE-2023-27483.
How can I identify if my application is vulnerable to CVE-2023-27483?
To determine if your application is vulnerable to CVE-2023-27483, check if it uses the affected versions of the Crossplane runtime and the 'Paved' type's 'SetValue' method with untrusted input.

CVE-2023-27483: fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

Remedy

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2023-27483?

How do I fix CVE-2023-27483?

Which versions of Crossplane are affected by CVE-2023-27483?

What is the impact of CVE-2023-27483 on applications?

How can I identify if my application is vulnerable to CVE-2023-27483?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2023-27483?

How do I fix CVE-2023-27483?

Which versions of Crossplane are affected by CVE-2023-27483?

What is the impact of CVE-2023-27483 on applications?

How can I identify if my application is vulnerable to CVE-2023-27483?