Go/github.com/kubernetes-csi/external-provisioner CVE-2019-11255: medium 6.5, EPSS 2.01%
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
Action: Upgrade github.com/kubernetes-csi/external-provisioner to 0.4.3 or later.
go get github.com/kubernetes-csi/external-provisioner@v0.4.3go get github.com/kubernetes-csi/external-provisioner@v1.0.2go get github.com/kubernetes-csi/external-provisioner@v1.2.2go get github.com/kubernetes-csi/external-provisioner@v1.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.4.3 | - |
| 1.0.0 | 1.0.2 | - |
| 1.2.0 | 1.2.2 | - |
| 1.3.0 | 1.3.1 | - |
Fixed versions
| 0.4.3 | 1.0.2 | 1.2.2 | 1.3.1 |
Sources
- osv: GHSA-f4w6-3rh6-6q4q
- https://nvd.nist.gov/vuln/detail/CVE-2019-11255
- https://github.com/kubernetes/kubernetes/issues/85233
- https://access.redhat.com/errata/RHSA-2019:4054
- https://access.redhat.com/errata/RHSA-2019:4096
- https://access.redhat.com/errata/RHSA-2019:4099
- https://access.redhat.com/errata/RHSA-2019:4225
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw
- https://security.netapp.com/advisory/ntap-20200810-0003
CVE-2019-11255 · published · modified · JSON