6.2

CVE-2023-27484: crossplane Improper Input Validation

CVSS: 6.2v3.1MediumModified
AliasesCGA-32v3-9566-jcm4CGA-r3hf-gww3-36jgGHSA-v829-x6hh-cqfq
Published 09-03-2023Last modified 25-02-2025
Open JSON

Vulnerability summary

CVE-2023-27484 is a medium (CVSS 6.2) Improper Input Validation vulnerability in crossplane. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.2/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.68%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-5376-728V-F745CGA-PGW2-JMGX-J6R6

Timeline

  1. 09-03-2023
    PublishedVulnerability first disclosed.
  2. 25-02-2025
    Last modifiedVulnerability information updated.

Description

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's `ToFieldPath`, which could lead to excessive memory usage once such Composition is selected for a Composite resource. Compositions allow users to specify patches inserting elements into arrays at an arbitrary index. When a Composition is selected for a Composite Resource, patches are evaluated and if a specified index is greater than the current size of the target slice, Crossplane will grow that slice up to the specified index, which could lead to an excessive amount of memory usage and therefore the Pod being OOM-Killed. The index is already capped to the maximum value for a uint32 (4294967295) when parsed, but that is still an unnecessarily large value. This issue has been addressed in versions 1.11.2, 1.10.3, and 1.9.2. Users are advised to upgrade. Users unable to upgrade can restrict write privileges on Compositions to only admin users as a workaround.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.68%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

0.00 pp

From 0.68% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • crossplane-crankAll versions (No fix recorded)
Crossplane1 product
  • crossplane< 1.9.2 | ≥ 1.9.0, < 1.9.2 | ≥ 1.10.0, < 1.10.3 | ≥ 1.11.0, < 1.11.2
Github.com/crossplane1 product
  • crossplane< 1.9.2 | ≥ 1.10.0, < 1.10.3 | ≥ 1.11.0, < 1.11.2
Wolfi1 product
  • crossplane-crankAll versions (No fix recorded)

4 vendors · 4 products

References

4 links