CVE-2023-38495: Crossplane vulnerable to possible image tampering from missing image validation for Packages
Impact
Crossplanes image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package.
Patches
The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of writing.
Workarounds
Only using images from trusted sources and keeping Package editing/creating privileges to administrators only, which should be both considered already best practices.
References
See ADA-XP-23-11 in the Security Audit's report.
Credits
This was reported as ADA-XP-23-11 by @AdamKorcz and @DavidKorczynski from Ada Logic and facilitated by OSTIF as part of the Security Audit sponsored by CNCF.
Other sources
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38495?
The severity of CVE-2023-38495 is critical (9.8/10).
How does CVE-2023-38495 impact Crossplane?
CVE-2023-38495 allows an attacker to tamper with Crossplane packages, compromising the security and integrity of the system.
Which versions of Crossplane are affected by CVE-2023-38495?
Crossplane versions up to 1.11.5 and versions between 1.12.0 and 1.12.3 are affected by CVE-2023-38495.
How can I patch CVE-2023-38495?
CVE-2023-38495 has been fixed in Crossplane versions 1.11.5, 1.12.3, and 1.13.0.
Where can I find more information about CVE-2023-38495?
You can find more information about CVE-2023-38495 in the following references: [GitHub Advisory](https://github.com/crossplane/crossplane/security/advisories/GHSA-pj4x-2xr5-w87m), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-38495).