Product · Kubernetes

Kubernetes Secrets Store CSI Driver

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 4.9

CVE-2020-8567

Kubernetes Secrets Store CSI Driver plugin directory traversals

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesys…

Kubernetes Kubernetes Secrets Store CSI Driver github.com/hashicorp/vault-csi-provider github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go

Jan 21, 2021
Medium 5.8

CVE-2020-8568

Kubernetes Secrets Store CSI Driver sync/rotate directory traversal

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes pa…

Kubernetes Kubernetes Secrets Store CSI Driver sigs.k8s.io/secrets-store-csi-driver Go

Jan 21, 2021