GHSA-2v35-wj4r-rcmv
Kubernetes Secrets Store CSI Driver plugins arbitrary file write
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/vault-csi-provider | < 0.0.6 | 0.0.6 |
| Go | github.com/Azure/secrets-store-csi-driver-provider-azure | < 0.0.10 | 0.0.10 |
| Go | github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp | < 0.2.0 | 0.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including `/var/lib/kubelet/pods`.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-8567
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
- https://github.com/Azure/secrets-store-csi-driver-provider-azure/pull/298
- https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/pull/74
- https://github.com/hashicorp/secrets-store-csi-driver-provider-vault/pull/50
- https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY