CVE-2023-37900CWE-400CWE-770

Crossplane vulnerable to denial of service from large image

Low · published July 27, 2023

CVSS v3.1
3.4
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2023-07-27T15:50Z
EPSS history
Timeline
  • 27 JUL 15:50Z
    Crossplane vulnerable to denial of service from large image
    cvelistv5