{"id":"CVE-2019-11255","aliases":["EUVD-2022-3689","GHSA-f4w6-3rh6-6q4q","RHSA-2019:4054","RHSA-2019:4096","RHSA-2019:4225"],"status":"published","title":"Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02014,"percentile":0.81033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2019-12-05T16:05:18Z","modified":"2026-10-24T10:47:42Z","fixes":[{"ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","fixed_in":["0.4.3","1.0.2","1.2.2","1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","fixed_in":["1.0.2","1.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-cephfs-provisioner","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-debuginfo","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-efs-provisioner","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-local-provisioner","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-manila-provisioner","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-snapshot-controller","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-snapshot-provisioner","fixed_in":["0:0.0.2-10.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-cephfs-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-debuginfo","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-efs-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-local-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-manila-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-snapshot-controller","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-snapshot-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-cephfs-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-debuginfo","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-efs-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-local-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-manila-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-snapshot-controller","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-snapshot-provisioner","fixed_in":["0:0.0.2-11.gitd3c94f0.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1"},{"last_affected":"1.1"}]}],"versions":["1.1"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1"},{"last_affected":"1.1"}]}],"versions":["1.1"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-resizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1"},{"last_affected":"0.1"}]}],"versions":["0.1"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/external-resizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"last_affected":"0.2"}]}],"versions":["0.2"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","versions":["1.1"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.2.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-provisioner","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","versions":["1.1"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-snapshotter/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.2.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-resizer","versions":["0.1"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/external-resizer","versions":["0.2"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-cephfs-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-efs-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-local-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-manila-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-snapshot-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-external-storage-snapshot-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-10.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-cephfs-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-efs-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-local-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-manila-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-snapshot-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el7","package":"openshift-external-storage-snapshot-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-cephfs-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-efs-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-local-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-manila-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-snapshot-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-external-storage-snapshot-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.2-11.gitd3c94f0.el7"}]}]}],"products":[{"vendor":"kubernetes","product":"external-provisioner"},{"vendor":"kubernetes","product":"external-resizer"},{"vendor":"kubernetes","product":"external-snapshotter"},{"vendor":"kubernetes","product":"kubernetes-csi external-provisioner"},{"vendor":"kubernetes","product":"kubernetes-csi external-resizer"},{"vendor":"kubernetes","product":"kubernetes-csi external-snapshotter"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/85233","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","report","web"]},{"url":"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIw","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4099","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4096","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4054","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4225","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200810-0003/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11255","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/aXiYN0q4uIw","tags":["web","article"]},{"url":"https://github.com/advisories/GHSA-f4w6-3rh6-6q4q"},{"url":"https://security.netapp.com/advisory/ntap-20200810-0003","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772727","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4054.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11255","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4096.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4225.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-11255","title":"Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","status":"published","published":"2019-12-05T16:05:18.735Z","modified":"2024-09-16T23:05:20.635Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2022-3689","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","status":"published","published":"2019-12-05T16:05:18Z","modified":"2024-09-16T23:05:20Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:54:57.254208Z"}],"ghsa":[{"id":"GHSA-f4w6-3rh6-6q4q","title":"Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","status":"published","published":"2022-05-24T17:02:42Z","modified":"2023-08-21T17:14:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2019-11255","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","status":"published","published":"2019-12-05T16:15:10.567Z","modified":"2026-06-17T02:12:38.04Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-11255","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","status":"published","published":"2019-12-05T16:15:10.567Z","modified":"2026-10-24T10:47:42.148189626Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-f4w6-3rh6-6q4q","title":"Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access","description":"Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (\u003cv0.4.3, \u003cv1.0.2, v1.1, \u003cv1.2.2, \u003cv1.3.1), external-snapshotter (\u003cv0.4.2, \u003cv1.0.2, v1.1, \u003c1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.","status":"published","published":"2022-05-24T17:02:42Z","modified":"2026-09-10T03:49:22.207582128Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"RHSA-2019:4054","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 openshift-external-storage security update","status":"published","published":"2024-09-16T03:22:28Z","modified":"2026-01-14T11:03:26.561833Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4096","title":"Red Hat Security Advisory: OpenShift Container Platform 4.2 openshift-external-storage security update","status":"published","published":"2024-09-16T03:22:17Z","modified":"2026-01-14T11:03:27.168623Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4225","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift-external-storage security update","status":"published","published":"2024-09-16T03:22:35Z","modified":"2026-01-14T11:03:27.950459Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"}]}}