Vulnerability · Published Jan 21, 2021 · Assigned by kubernetes
CVE-2020-8568Kubernetes Secrets Store CSI Driver sync/rotate directory traversal
Medium 5.8
In plain English
A medium-severity improper input validation in Kubernetes Secrets Store CSI Driver from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | sigs.k8s.io/secrets-store-csi-driver | 0.0.17 | GHSA-5cgx-vhfp-6cf9 |
| Go | sigs.k8s.io/secrets-store-csi-driver | 0.0.17 | GO-2022-0629 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes Secrets Store CSI Driver | Kubernetes Secrets Store CSI Driver v0.0.15Kubernetes Secrets Store CSI Driver v0.0.16 |
Weakness: CWE-24, CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N