GHSA-3hw7-qj9h-r835 Gardener allows bypassing project secret validation which can lead to privilege escalation

• Go github.com/gardener/gardener: < 1.116.4 → fixed in 1.116.4 • Go github.com/gardener/gardener: >= 1.117.0, < 1.117.5 → fixed in 1.117.5 • Go github.com/gardener/gardener: >= 1.118.0, < 1.118.2 → fixed in 1.118.2

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. Am I Vulnerable? This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. Affected Components • `gardener/gardener` Affected Versions • < v1.116.4 • < v1.117.5 • < v1.118.2 • < v1.119.0 Fixed Versions • &gt;= v1.116.4 • &gt;= v1.117.5 • &gt;= v1.118.2 • &gt;= v1.119.0 How do I mitigate this vulnerability? Update to a fixed version.