Vulnerabilities in pkg:golang/github.com/kubernetes-csi/external-snapshotter/v6

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f4w6-3rh6-6q4q",
  "modified" : "2023-07-18T22:01:34Z",
  "published" : "2022-05-24T17:02:42Z",
  "aliases" : [ "CVE-2019-11255" ],
  "summary" : "Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access",
  "details" : "Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-provisioner"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.4.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-provisioner"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0"
      }, {
        "fixed" : "1.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-provisioner"
    },
    "versions" : [ "1.1" ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-provisioner"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.2.0"
      }, {
        "fixed" : "1.2.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-provisioner"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.3.0"
      }, {
        "fixed" : "1.3.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-snapshotter/v6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0"
      }, {
        "fixed" : "1.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-snapshotter/v6"
    },
    "versions" : [ "1.1" ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-snapshotter/v6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.2.0"
      }, {
        "fixed" : "1.2.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-resizer"
    },
    "versions" : [ "0.1" ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kubernetes-csi/external-resizer"
    },
    "versions" : [ "0.2" ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2019-11255"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kubernetes/kubernetes/issues/85233"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4054"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4096"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4099"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4225"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20200810-0003"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-07-18T22:01:34Z",
    "nvd_published_at" : "2019-12-05T16:15:00Z"
  }
}