{"id":"GHSA-f4w6-3rh6-6q4q","summary":"Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access","details":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","aliases":["CVE-2019-11255"],"modified":"2026-02-04T02:19:49.781504Z","published":"2022-05-24T17:02:42Z","related":["CGA-mwjg-2qqj-j36r"],"database_specific":{"cwe_ids":["CWE-20"],"github_reviewed_at":"2023-07-18T22:01:34Z","github_reviewed":true,"nvd_published_at":"2019-12-05T16:15:00Z","severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11255"},{"type":"WEB","url":"https://github.com/kubernetes/kubernetes/issues/85233"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:4054"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:4096"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:4099"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:4225"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20200810-0003"}],"affected":[{"package":{"name":"github.com/kubernetes-csi/external-provisioner","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-provisioner"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-provisioner","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-provisioner"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-provisioner","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-provisioner"},"versions":["1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-provisioner","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-provisioner"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.2.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-provisioner","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-provisioner"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-snapshotter/v6","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-snapshotter/v6"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-snapshotter/v6","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-snapshotter/v6"},"versions":["1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-snapshotter/v6","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-snapshotter/v6"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.2.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-resizer","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-resizer"},"versions":["0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}},{"package":{"name":"github.com/kubernetes-csi/external-resizer","ecosystem":"Go","purl":"pkg:golang/github.com/kubernetes-csi/external-resizer"},"versions":["0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f4w6-3rh6-6q4q/GHSA-f4w6-3rh6-6q4q.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}]}