Executive brief
Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane
Affected products
- Go github.com/crossplane/crossplane
Junglewise Threat Intelligence
CVE-2023-38495: GO-2023-1980 - Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane
CVE-2023-38495 · Severity: low · CVSS 3.1 · Published 2024-08-20
Technologies: github.com/crossplane/crossplane (Go). Vendors: Go.
Related threats
- GO-2026-5709 - Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
- GO-2024-3219 - github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
- GO-2023-1979 - Denial of service from large image in github.com/crossplane/crossplane