Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVjZ3gtdmhmcC02Y2Y5

Directory traversal in Kubernetes Secrets Store CSI Driver

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

Specific Go Packages Affected

sigs.k8s.io/secrets-store-csi-driver/controllers
sigs.k8s.io/secrets-store-csi-driver/pkg/rotation
sigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store

Permalink: https://github.com/advisories/GHSA-5cgx-vhfp-6cf9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVjZ3gtdmhmcC02Y2Y5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS Percentage: 0.00087
EPSS Percentile: 0.38508

Identifiers: GHSA-5cgx-vhfp-6cf9, CVE-2020-8568
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-8568
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/pull/371
• https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/commit/c2cbb19e2eef16638fa0523383788a4bc22231fd
• https://pkg.go.dev/vuln/GO-2022-0629
• https://github.com/advisories/GHSA-5cgx-vhfp-6cf9

Repository: https://github.com/kubernetes-sigs/secrets-store-csi-driver
Blast Radius: 9.6

Affected Packages