github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools...

GO-2023-1979 Denial of service from large image in github.com/crossplane/crossplane

Denial of service from large image in github.com/crossplane/crossplane...

GO-2023-1980 Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane

Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: multus-cni-fips, kubescape, glab, fluent-operator, rabbitmq-cluster-operator, mc, age, prometheus-stackdriver-exporter, temporal, go, vault-k8s, dataplaneapi-fips, slsa-verifier, spire-server-fips, spicedb, cloud-sql-proxy-fips, protoc-gen-go, mods, caddy-fips, helm,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: multus-cni-fips, runc, kube-bench-fips, vertical-pod-autoscaler, falcosidekick-fips, kubescape, glab, step-ca-fips, flux-notification-controller, kubernetes-ingress-defaultbackend, cadvisor, mc, croc, prometheus-mongodb-exporter, thanos-fips, lazygit, bank-vaults-fip...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: aactl, conftest, kargo, wolfictl, kubescape, cadvisor, cilium-cli, docker-compose, prometheus, trivy, grype, spire-server-fips, buildkitd, dagger, spire-server, ctop, kaniko, zot, cadvisor-fips, crossplane, melange, tkn, ko, up, syft, conftest-fips, buf, loki...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, pulumi-kubernetes-operator, cosign, crossplane-provider-aws-sns, prometheus-adapter, hubble, crossplane-provider-aws-kinesis, temporal, vexctl, crossplane-provider-azure-storage, aactl, helm-push, kubeflow-pipelines, crossplane-provider-aws-route53,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubescape, rabbitmq-cluster-operator, mc, prometheus-stackdriver-exporter, temporal, vault-k8s, slsa-verifier, spire-server-fips, spicedb, cloud-sql-proxy-fips, caddy-fips, helm, prometheus-redis-exporter-fips, cass-operator-fips, sigstore-scaffolding, metacontroller...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: nri-mssql, cni-plugins, ip-masq-agent, pulumi-kubernetes-operator, prometheus-adapter, temporal, vexctl, helm-push, kubeflow-pipelines, src-fingerprint, bazelisk, helm, rqlite, supercronic, gosu, metallb, kpt, memcached-exporter, vite, kubernetes-csi-livenessprobe,...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, crossplane-provider-family-aws, pulumi-kubernetes-operator, argo-workflows, gitness, aactl, wolfictl, kubescape, crossplane-provider-aws-cloudfront, crossplane-provider-aws-dynamodb, gomplate, flux-notification-controller,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: runc, yq, vertical-pod-autoscaler, kubescape, flux-notification-controller, kubernetes-ingress-defaultbackend, kubevela, mc, prometheus-mongodb-exporter, rqlite, bank-vaults-fips, gke-gcloud-auth-plugin, prometheus-stackdriver-exporter, prometheus-alertmanager, go,...

Missing Image Validation

github.com/crossplane/crossplane is vulnerable to Missing Image Validation. The vulnerability exists in imageback.go due to a lack of image validation inside the packages, which allows an attacker bypass the detection mechanism for tampered packages...

Denial Of Service (DoS)

github.com/crossplane/crossplane is vulnerable to Denial of Service DoS attacks. An arbitrary huge image could be referenced by a package created by a high-privileged user, which the library would then parse, potentially using up all the memory and causing the container to be OOMKilled, resulting...

Possible image tampering from missing image validation for Packages

Impact Crossplanes image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. Patches The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of...

GHSA-PJ4X-2XR5-W87M Possible image tampering from missing image validation for Packages

Impact Crossplanes image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. Patches The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of...

CVE-2023-38495

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

Code injection

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

CVE-2023-38495 Crossplane vulnerable to possible image tampering from missing image validation for Packages

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

CVE-2023-38495 Crossplane vulnerable to possible image tampering from missing image validation for Packages

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

CVE-2023-38495

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...