PT-2023-26476 · Unknown · Crossplane

Adamkorcz + 1 · Published 2023-07-27 · Updated 2026-01-26 · CVE-2023-38495

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crossplane versions prior to 1.11.5 Crossplane versions prior to 1.12.3 Crossplane versions prior to 1.13.0

Description Crossplane's image backend does not validate the byte contents of Crossplane packages, allowing an attacker to tamper with a package without detection. The issue has been fixed in versions 1.11.5, 1.12.3, and 1.13.0. As a workaround, users should only use images from trusted sources and keep package editing/creating privileges restricted to administrators.

Recommendations For versions prior to 1.11.5, update to version 1.11.5 or later. For versions prior to 1.12.3, update to version 1.12.3 or later. For versions prior to 1.13.0, update to version 1.13.0 or later. As a temporary workaround, consider only using images from trusted sources and restricting package editing/creating privileges to administrators only.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-CROSSPLANE-2023-38495

CVE-2023-38495

GHSA-PJ4X-2XR5-W87M

GO-2023-1980

Affected Products

Crossplane

References · 11

• 🔥 https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38495.json · Exploit
• https://github.com/crossplane/crossplane/security/advisories/GHSA-pj4x-2xr5-w87m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38495 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38495 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pj4x-2xr5-w87m · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1980 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-crossplane-2023-38495 · Vendor Advisory
• https://github.com/crossplane/crossplane · Note
• https://t.me/cvenotify/55349 · Telegram Post
• https://t.me/cibsecurity/67346 · Telegram Post