| { |
| "schema_version": "1.3.1", |
| "id": "GO-2025-4240", |
| "modified": "0001-01-01T00:00:00Z", |
| "published": "0001-01-01T00:00:00Z", |
| "aliases": [ |
| "CVE-2025-13281", |
| "GHSA-r6j8-c6r2-37rr" |
| ], |
| "summary": "Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes", |
| "details": "Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes", |
| "affected": [ |
| { |
| "package": { |
| "name": "k8s.io/kubernetes", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "1.32.10" |
| }, |
| { |
| "introduced": "1.33.0-alpha.0" |
| }, |
| { |
| "fixed": "1.33.6" |
| }, |
| { |
| "introduced": "1.34.0-alpha.0" |
| }, |
| { |
| "fixed": "1.34.2" |
| } |
| ] |
| } |
| ], |
| "ecosystem_specific": {} |
| } |
| ], |
| "references": [ |
| { |
| "type": "ADVISORY", |
| "url": "https://github.com/advisories/GHSA-r6j8-c6r2-37rr" |
| }, |
| { |
| "type": "WEB", |
| "url": "http://www.openwall.com/lists/oss-security/2025/12/01/4" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/kubernetes/kubernetes/commit/7506ce804c20696ba32cdb72126270ceaed06e24" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/kubernetes/kubernetes/commit/97650c1c4fe15cbb7756ba95b3edc8a8665063ca" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/kubernetes/kubernetes/commit/dbe17dfe7773563eac95534040f413ada6d2b421" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/kubernetes/kubernetes/issues/135525" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ" |
| } |
| ], |
| "database_specific": { |
| "url": "https://pkg.go.dev/vuln/GO-2025-4240", |
| "review_status": "REVIEWED" |
| } |
| } |
