CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

PT-2023-21159 · Unknown · Crossplane-Runtime

Name of the Vulnerable Software and Affected Versions: crossplane-runtime versions prior to 0.16.1 crossplane-runtime versions prior to 0.19.2 Description: An out of memory panic issue has been discovered in crossplane-runtime, a set of Go libraries used to build Kubernetes controllers in...

crossplane 资源管理错误漏洞

crossplane is a framework for building cloud-native control planes without writing code. A resource management error vulnerability exists in crossplane-runtime. An attacker could exploit this vulnerability to cause an out-of-memory condition...

CVE-2023-27484: Uncontrolled Resource Consumption

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's ToFieldPath, which could lead to...

crossplane 资源管理错误漏洞

crossplane is a framework for building cloud-native control planes without writing code. A resource management error vulnerability exists in crossplane-runtime that stems from user-supplied input that is not properly validated, which could use too much memory and lead to out of memory...

CVE-2023-27483: Uncontrolled Resource Consumption

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...