Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
nfs-subdir-external-provisioner may accept unsafe resumed connections
published 4 days ago
Summary
The nfs-subdir-external-provisioner component can mistakenly allow a TLS connection to continue using a previously established session even after the list of trusted certificates has been changed. This could let an unauthorized party keep a connection that should have been rejected. Update the package to the latest version or ensure certificate lists are not altered during a session.
What to do
- Update cleanstart nfs-subdir-external-provisioner to version 4.0.18-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | nfs-subdir-external-provisioner |
< 4.0.18-r3 Fix: upgrade to 4.0.18-r3
|
Original advisory text
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Security vulnerability affects the nfs-subdir-external-provisioner package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLEANSTART-2026-RQ61513 · OSV
Track software like this
Free during beta