Kubernetes Secrets Store CSI Driver sync/rotate directory traversal
CVE-2020-8568

5.8MEDIUM

Key Information:

Vendor
Kubernetes
Status
Kubernetes Secrets Store Csi Driver
Vendor
CVE Published:
21 January 2021

Summary

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

Affected Version(s)

Kubernetes Secrets Store CSI Driver Kubernetes Secrets Store CSI Driver v0.0.15

Kubernetes Secrets Store CSI Driver Kubernetes Secrets Store CSI Driver v0.0.16

References

https://groups.google.com/g/kubernetes-secrets-store-csi-...
x_refsource_MISC
https://github.com/kubernetes-sigs/secrets-store-csi-driv...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tommy Murphy of Google
.