CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

CVE-2023-27484: Uncontrolled Resource Consumption

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's ToFieldPath, which could lead to...

PT-2023-21159 · Unknown · Crossplane-Runtime

Name of the Vulnerable Software and Affected Versions: crossplane-runtime versions prior to 0.16.1 crossplane-runtime versions prior to 0.19.2 Description: An out of memory panic issue has been discovered in crossplane-runtime, a set of Go libraries used to build Kubernetes controllers in...

CVE-2023-27483: Uncontrolled Resource Consumption

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

PT-2023-21160

Name of the Vulnerable Software and Affected Versions crossplane-runtime versions prior to 1.11.2 crossplane-runtime versions prior to 1.10.3 crossplane-runtime versions prior to 1.9.2 Description The issue affects crossplane-runtime, a set of Go libraries used to build Kubernetes controllers in...

Crossplane resource management error vulnerability

crossplane is a framework for building cloud-native control planes without writing code. A resource management error vulnerability exists in crossplane-runtime. An attacker could exploit this vulnerability to cause an out-of-memory condition...

Crossplane resource management error vulnerability

crossplane is a framework for building cloud-native control planes without writing code. A resource management error vulnerability exists in crossplane-runtime that stems from user-supplied input that is not properly validated, which could use too much memory and lead to out of memory...

crossplane:fuzz_find_xpkg_in_dir: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5553941389901824 Project: crossplane Fuzzing Engine: libFuzzer Fuzz Target: fuzzfindxpkgindir Job Type: libfuzzerasancrossplane Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...

crossplane:fuzz_ForCompositeResource: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4666364971581440 Project: crossplane Fuzzing Engine: libFuzzer Fuzz Target: fuzzForCompositeResource Job Type: libfuzzerasancrossplane Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

crossplane:fuzz_parse: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6517735198162944 Project: crossplane Fuzzing Engine: libFuzzer Fuzz Target: fuzzparse Job Type: libfuzzerasancrossplane Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00c8248c6f0f Crash State: NULL Sanitizer: address ASAN Recommende...