{"id":"CVE-2019-11255","details":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","aliases":["GHSA-f4w6-3rh6-6q4q"],"modified":"2026-07-08T05:57:45.136807176Z","published":"2019-12-05T16:15:10.567Z","related":["CGA-mwjg-2qqj-j36r"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"redhat:openshift_container_platform","cpes":["cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.11"},{"last_affected":"3.11"},{"introduced":"4.1"},{"last_affected":"4.1"},{"introduced":"4.2"},{"last_affected":"4.2"}]}]},"references":[{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:4054"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:4096"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:4099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:4225"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20200810-0003/"},{"type":"REPORT","url":"https://github.com/kubernetes/kubernetes/issues/85233"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes-csi/external-provisioner","events":[{"introduced":"673bd220cbf78ba69180077523f35a072ed948d2"},{"last_affected":"3aa7a5d8067b030c42374210b0766de394062000"},{"introduced":"16f5327a442fd4c0db10edd029cc6eef167db9c7"},{"last_affected":"9a258a0accf64d688f312697db871ceaf42e6478"},{"introduced":"cecb5a962a7503ef9aa52874e4b75e638b63705e"},{"last_affected":"971feacb437fc5a8033e99c68002d7452a467a32"},{"introduced":"27750ab12343e6b5d6ed1e277b161aa45bc02cfd"},{"last_affected":"27750ab12343e6b5d6ed1e277b161aa45bc02cfd"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:kubernetes:external-provisioner:*:*:*:*:*:*:*:*","cpe:2.3:a:kubernetes:external-provisioner:1.3.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.4.1"},{"last_affected":"0.4.2"},{"introduced":"1.0.0"},{"last_affected":"1.0.1"},{"introduced":"1.1.0"},{"last_affected":"1.2.1"},{"introduced":"1.3.0"},{"last_affected":"1.3.0"}]}}],"versions":["1.3.0","v1.2.1","v1.3.0","v1.2.0-rc1","v1.2.0","v1.1.0","v1.0.1-rc1","v1.0.1","v0.4.2","v0.4.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11255.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes-csi/external-resizer","events":[{"introduced":"61904896301627bba78a7ef3f37804a83df9e9e4"},{"last_affected":"07a4fd906acbb8014c0f5d05578071c0a9559251"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:kubernetes:external-resizer:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.1.0"},{"last_affected":"0.2.0"}]}}],"versions":["v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11255.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes-csi/external-snapshotter","events":[{"introduced":"590aeed7566eaa0409ae852000e570aa0a5c2720"},{"last_affected":"5bad0876534419b708ca88cecdfae0c1c39a1e1e"},{"introduced":"0"},{"last_affected":"0d2cdd7bde5ea9d41ae47ef4184ca20ebe0435e1"},{"introduced":"ac33959738598e55a0a0a9d5a2d08d7445f27f36"},{"last_affected":"34fa9aad47eef93ca8281c2a029f031852cfefa5"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:kubernetes:external-snapshotter:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.4.0"},{"last_affected":"0.4.1"},{"introduced":"1.0.0"},{"last_affected":"1.0.1"},{"introduced":"1.1.0"},{"last_affected":"1.2.1"}]}}],"versions":["v0.4.1","v1.2.1","v1.2.0","v1.1.0","v1.0.1-rc1","v1.0.1","v1.0.0-rc4","v1.0.0-rc3","v1.0.0-rc2","v0.4.0-rc.1","v0.4.0","v0.5.0-alpha.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11255.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}]}