Skip to content
Fencer Vulns
medium 4.8

CVE-2019-11255 json

Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

published 2019-12-05 6 y ago modified 2026-09-10 1 mo ago also GHSA-f4w6-3rh6-6q4q , EUVD-2022-3689

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

Patch / fix

  • go github.com/kubernetes-csi/external-provisioner 0.4.3, 1.0.2, 1.2.2, 1.3.1
  • go github.com/kubernetes-csi/external-snapshotter/v6 1.0.2, 1.2.2
  • Kubernetes kubernetes-csi external-provisioner prior to 0.4.3
  • openshift-external-storage openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage-efs-provisioner openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage-local-provisioner openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage-cephfs-provisioner openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage-manila-provisioner openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage-snapshot-controller openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage-snapshot-provisioner openshift 4.2, openshift 4.1 0.0.2-11.gitd3c94f0.el7
  • openshift-external-storage openshift 3.11 0.0.2-10.gitd3c94f0.el7

red hat advisories RHSA-2019:4225RHSA-2019:4054RHSA-2019:4096

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-11255 updated cvss 4.8

kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

  • Red Hat OpenShift Container Platform 3.11 openshift-external-storage 0.0.2-10.gitd3c94f0.el7, openshift-external-storage-efs-provisioner 0.0.2-10.gitd3c94f0.el7, openshift-external-storage-local-provisioner 0.0.2-10.gitd3c94f0.el7, openshift-external-storage-cephfs-provisioner 0.0.2-10.gitd3c94f0.el7, openshift-external-storage-manila-provisioner 0.0.2-10.gitd3c94f0.el7, openshift-external-storage-snapshot-controller 0.0.2-10.gitd3c94f0.el7, +1 more
    fixed: vendor fix RHSA-2019:4054
  • Red Hat OpenShift Container Platform 4.1 openshift-external-storage 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-efs-provisioner 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-local-provisioner 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-cephfs-provisioner 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-manila-provisioner 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-snapshot-controller 0.0.2-11.gitd3c94f0.el7, +1 more
    fixed: vendor fix RHSA-2019:4225
  • Red Hat OpenShift Container Platform 4.2 openshift-external-storage 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-efs-provisioner 0.0.2-11.gitd3c94f0.el7, openshift4/ose-csi-external-provisioner-rhel7 v4.2.10-201912022352, openshift-external-storage-local-provisioner 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-cephfs-provisioner 0.0.2-11.gitd3c94f0.el7, openshift-external-storage-manila-provisioner 0.0.2-11.gitd3c94f0.el7, +2 more
    fixed: vendor fix RHSA-2019:4096
  • Red Hat OpenShift Container Platform 3.11 csi-provisioner
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.01% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/kubernetes-csi/external-provisioner
<0.4.3
>=1.0.0, <1.0.2
1 listed version
>=1.2.0, <1.2.2
>=1.3.0, <1.3.1
0.4.3
1.0.2
1.2.2
1.3.1
go github.com/kubernetes-csi/external-snapshotter/v6
>=1.0.0, <1.0.2
1 listed version
>=1.2.0, <1.2.2
1.0.2
1.2.2
go github.com/kubernetes-csi/external-resizer
1 listed version
 no fix listed

Affected products

  • Kubernetes kubernetes-csi external-provisioner
  • Kubernetes kubernetes-csi external-snapshotter
  • Kubernetes kubernetes-csi external-resizer

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.