x/vulndb: potential Go vuln in github.com/crossplane/crossplane: CVE-2023-37900

[GoVulnBot]

CVE-2023-37900 references github.com/crossplane/crossplane, which may be a Go module.

Description:
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-37900
• JSON: https://github.com/CVEProject/cvelist/tree/1b323feb5a4378efe36900a2e61b28ca51a9d2cb/2023/37xxx/CVE-2023-37900.json
• advisory: GHSA-68p4-95xf-7gx8
• web: https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf
• Imported by: https://pkg.go.dev/github.com/crossplane/crossplane?tab=importedby

Cross references:

• Module github.com/crossplane/crossplane appears in issue x/vulndb: potential Go vuln in github.com/crossplane/crossplane: CVE-2023-27484 #1624 DEPENDENT_VULNERABILITY

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/crossplane/crossplane
      vulnerable_at: 1.13.0
      packages:
        - package: crossplane
description: |-
    Crossplane is a framework for building cloud native control planes without
    needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a
    high-privileged user could create a Package referencing an arbitrarily large
    image containing that Crossplane would then parse, possibly resulting in
    exhausting all the available memory and therefore in the container being
    OOMKilled. The impact is limited due to the high privileges required to be able
    to create the Package and the eventually consistency nature of controller. This
    issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.
cves:
    - CVE-2023-37900
references:
    - advisory: https://github.com/crossplane/crossplane/security/advisories/GHSA-68p4-95xf-7gx8
    - web: https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606789 mentions this issue: data/reports: unexclude 20 reports (9)