Search criteria

2 vulnerabilities found for secret_manager_provider_for_secret_store_csi_driver by google

CVE-2020-8567 (GCVE-0-2020-8567)

Vulnerability from nvd – Published: 2021-01-21 17:09 – Updated: 2024-09-16 18:23
VLAI?
Title
Kubernetes Secrets Store CSI Driver plugin directory traversals
Summary
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Severity ?
4.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
CWE
  • CWE-24 - Path Traversal: '../filedir'
Assigner
References
Impacted products
Vendor Product Version
Kubernetes Kubernetes Secrets Store CSI Driver Affected: Vault Plugin , < v0.0.6 (custom)
Affected: Azure Plugin , < v0.0.10 (custom)
Affected: GCP Plugin , < v0.2.0 (custom)
Create a notification for this product.
Credits
Tommy Murphy of Google
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:03:46.223Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kubernetes Secrets Store CSI Driver",
          "vendor": "Kubernetes",
          "versions": [
            {
              "lessThan": "v0.0.6",
              "status": "affected",
              "version": "Vault Plugin",
              "versionType": "custom"
            },
            {
              "lessThan": "v0.0.10",
              "status": "affected",
              "version": "Azure Plugin",
              "versionType": "custom"
            },
            {
              "lessThan": "v0.2.0",
              "status": "affected",
              "version": "GCP Plugin",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tommy Murphy of Google"
        }
      ],
      "datePublic": "2020-11-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-21T17:09:21",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
        }
      ],
      "source": {
        "defect": [
          "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Kubernetes Secrets Store CSI Driver plugin directory traversals",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@kubernetes.io",
          "DATE_PUBLIC": "2020-11-16T21:00:00.000Z",
          "ID": "CVE-2020-8567",
          "STATE": "PUBLIC",
          "TITLE": "Kubernetes Secrets Store CSI Driver plugin directory traversals"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kubernetes Secrets Store CSI Driver",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Vault Plugin",
                            "version_value": "v0.0.6"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "Azure Plugin",
                            "version_value": "v0.0.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "GCP Plugin",
                            "version_value": "v0.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Kubernetes"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Tommy Murphy of Google"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-24 Path Traversal: \u0027../filedir\u0027"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY",
              "refsource": "MISC",
              "url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
            },
            {
              "name": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384",
              "refsource": "MISC",
              "url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
            }
          ]
        },
        "source": {
          "defect": [
            "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2020-8567",
    "datePublished": "2021-01-21T17:09:21.322492Z",
    "dateReserved": "2020-02-03T00:00:00",
    "dateUpdated": "2024-09-16T18:23:40.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8567 (GCVE-0-2020-8567)

Vulnerability from cvelistv5 – Published: 2021-01-21 17:09 – Updated: 2024-09-16 18:23
VLAI?
Title
Kubernetes Secrets Store CSI Driver plugin directory traversals
Summary
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Severity ?
4.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
CWE
  • CWE-24 - Path Traversal: '../filedir'
Assigner
References
Impacted products
Vendor Product Version
Kubernetes Kubernetes Secrets Store CSI Driver Affected: Vault Plugin , < v0.0.6 (custom)
Affected: Azure Plugin , < v0.0.10 (custom)
Affected: GCP Plugin , < v0.2.0 (custom)
Create a notification for this product.
Credits
Tommy Murphy of Google
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:03:46.223Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kubernetes Secrets Store CSI Driver",
          "vendor": "Kubernetes",
          "versions": [
            {
              "lessThan": "v0.0.6",
              "status": "affected",
              "version": "Vault Plugin",
              "versionType": "custom"
            },
            {
              "lessThan": "v0.0.10",
              "status": "affected",
              "version": "Azure Plugin",
              "versionType": "custom"
            },
            {
              "lessThan": "v0.2.0",
              "status": "affected",
              "version": "GCP Plugin",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tommy Murphy of Google"
        }
      ],
      "datePublic": "2020-11-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-21T17:09:21",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
        }
      ],
      "source": {
        "defect": [
          "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Kubernetes Secrets Store CSI Driver plugin directory traversals",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@kubernetes.io",
          "DATE_PUBLIC": "2020-11-16T21:00:00.000Z",
          "ID": "CVE-2020-8567",
          "STATE": "PUBLIC",
          "TITLE": "Kubernetes Secrets Store CSI Driver plugin directory traversals"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kubernetes Secrets Store CSI Driver",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Vault Plugin",
                            "version_value": "v0.0.6"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "Azure Plugin",
                            "version_value": "v0.0.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "GCP Plugin",
                            "version_value": "v0.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Kubernetes"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Tommy Murphy of Google"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-24 Path Traversal: \u0027../filedir\u0027"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY",
              "refsource": "MISC",
              "url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
            },
            {
              "name": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384",
              "refsource": "MISC",
              "url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
            }
          ]
        },
        "source": {
          "defect": [
            "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2020-8567",
    "datePublished": "2021-01-21T17:09:21.322492Z",
    "dateReserved": "2020-02-03T00:00:00",
    "dateUpdated": "2024-09-16T18:23:40.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}