GitHub Advisoryadvisory · Go

GHSA-5cgx-vhfp-6cf9 Directory traversal in Kubernetes Secrets Store CSI Driver

MEDIUM Published 2022-02-15 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-8568
Ecosystem
Go
Packages
sigs.k8s.io/secrets-store-csi-driver
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-22, CWE-24
Reviewed
2021-05-12

Affected packages

• Go sigs.k8s.io/secrets-store-csi-driver: >= 0.0.15, < 0.0.17 → fixed in 0.0.17

Description

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a `SecretProviderClassPodStatus/Status` resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under `var/lib/kubelet/pods` that contain other Kubernetes Secrets. Specific Go Packages Affected sigs.k8s.io/secrets-store-csi-driver/controllers sigs.k8s.io/secrets-store-csi-driver/pkg/rotation sigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store

Related

Alias · CVE (1)

  • CVE-2020-8568 Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status… vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-24 Path Traversal: '../filedir' weakness

References