Search criteria
3 vulnerabilities found for secret_manager_provider_for_secret_store_csi_driver by google
FKIE_CVE-2020-8567
Vulnerability from fkie_nvd - Published: 2021-01-21 17:15 - Updated: 2024-11-21 05:39
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
References
| URL | Tags | ||
|---|---|---|---|
| jordan@liggitt.net | https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384 | Patch, Third Party Advisory | |
| jordan@liggitt.net | https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY | Mailing List, Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:secret_manager_provider_for_secret_store_csi_driver:*:*:*:*:*:kubernetes:*:*",
"matchCriteriaId": "FF1065B6-815D-49AC-9071-2366DFD8918C",
"versionEndExcluding": "0.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hashicorp:vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:*",
"matchCriteriaId": "0A30166E-B020-4E14-ACB4-87A99EEE788A",
"versionEndExcluding": "0.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_key_vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:*",
"matchCriteriaId": "C3941507-D6C5-4263-B6C4-56FC0625C6DE",
"versionEndExcluding": "0.0.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
},
{
"lang": "es",
"value": "Kubernetes Secrets Store CSI Driver Vault Plugin anterior a versi\u00f3n v0.0.6, Azure Plugin anterior a versi\u00f3n v0.0.10 y GCP Plugin anterior a versi\u00f3n v0.2.0, permiten a un atacante que puede crear objetos SecretProviderClass especialmente dise\u00f1ados para escribir en rutas de archivo arbitrarias en el sistema de archivos host , incluyendo la biblioteca /var/lib/kubelet/pods"
}
],
"id": "CVE-2020-8567",
"lastModified": "2024-11-21T05:39:02.770",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 2.7,
"source": "jordan@liggitt.net",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-21T17:15:14.063",
"references": [
{
"source": "jordan@liggitt.net",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
},
{
"source": "jordan@liggitt.net",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
}
],
"sourceIdentifier": "jordan@liggitt.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-24"
}
],
"source": "jordan@liggitt.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2020-8567 (GCVE-0-2020-8567)
Vulnerability from cvelistv5 – Published: 2021-01-21 17:09 – Updated: 2024-09-16 18:23
VLAI?
Title
Kubernetes Secrets Store CSI Driver plugin directory traversals
Summary
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Severity ?
4.9 (Medium)
CWE
- CWE-24 - Path Traversal: '../filedir'
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Kubernetes | Kubernetes Secrets Store CSI Driver |
Affected:
Vault Plugin , < v0.0.6
(custom)
Affected: Azure Plugin , < v0.0.10 (custom) Affected: GCP Plugin , < v0.2.0 (custom) |
Credits
Tommy Murphy of Google
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:03:46.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Kubernetes Secrets Store CSI Driver",
"vendor": "Kubernetes",
"versions": [
{
"lessThan": "v0.0.6",
"status": "affected",
"version": "Vault Plugin",
"versionType": "custom"
},
{
"lessThan": "v0.0.10",
"status": "affected",
"version": "Azure Plugin",
"versionType": "custom"
},
{
"lessThan": "v0.2.0",
"status": "affected",
"version": "GCP Plugin",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tommy Murphy of Google"
}
],
"datePublic": "2020-11-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-21T17:09:21",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
}
],
"source": {
"defect": [
"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
],
"discovery": "INTERNAL"
},
"title": "Kubernetes Secrets Store CSI Driver plugin directory traversals",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "2020-11-16T21:00:00.000Z",
"ID": "CVE-2020-8567",
"STATE": "PUBLIC",
"TITLE": "Kubernetes Secrets Store CSI Driver plugin directory traversals"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Kubernetes Secrets Store CSI Driver",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Vault Plugin",
"version_value": "v0.0.6"
},
{
"version_affected": "\u003c",
"version_name": "Azure Plugin",
"version_value": "v0.0.10"
},
{
"version_affected": "\u003c",
"version_name": "GCP Plugin",
"version_value": "v0.2.0"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tommy Murphy of Google"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-24 Path Traversal: \u0027../filedir\u0027"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY",
"refsource": "MISC",
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"name": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384",
"refsource": "MISC",
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
}
]
},
"source": {
"defect": [
"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2020-8567",
"datePublished": "2021-01-21T17:09:21.322492Z",
"dateReserved": "2020-02-03T00:00:00",
"dateUpdated": "2024-09-16T18:23:40.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-8567 (GCVE-0-2020-8567)
Vulnerability from nvd – Published: 2021-01-21 17:09 – Updated: 2024-09-16 18:23
VLAI?
Title
Kubernetes Secrets Store CSI Driver plugin directory traversals
Summary
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Severity ?
4.9 (Medium)
CWE
- CWE-24 - Path Traversal: '../filedir'
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Kubernetes | Kubernetes Secrets Store CSI Driver |
Affected:
Vault Plugin , < v0.0.6
(custom)
Affected: Azure Plugin , < v0.0.10 (custom) Affected: GCP Plugin , < v0.2.0 (custom) |
Credits
Tommy Murphy of Google
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:03:46.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Kubernetes Secrets Store CSI Driver",
"vendor": "Kubernetes",
"versions": [
{
"lessThan": "v0.0.6",
"status": "affected",
"version": "Vault Plugin",
"versionType": "custom"
},
{
"lessThan": "v0.0.10",
"status": "affected",
"version": "Azure Plugin",
"versionType": "custom"
},
{
"lessThan": "v0.2.0",
"status": "affected",
"version": "GCP Plugin",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tommy Murphy of Google"
}
],
"datePublic": "2020-11-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-21T17:09:21",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
}
],
"source": {
"defect": [
"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
],
"discovery": "INTERNAL"
},
"title": "Kubernetes Secrets Store CSI Driver plugin directory traversals",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "2020-11-16T21:00:00.000Z",
"ID": "CVE-2020-8567",
"STATE": "PUBLIC",
"TITLE": "Kubernetes Secrets Store CSI Driver plugin directory traversals"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Kubernetes Secrets Store CSI Driver",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Vault Plugin",
"version_value": "v0.0.6"
},
{
"version_affected": "\u003c",
"version_name": "Azure Plugin",
"version_value": "v0.0.10"
},
{
"version_affected": "\u003c",
"version_name": "GCP Plugin",
"version_value": "v0.2.0"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tommy Murphy of Google"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-24 Path Traversal: \u0027../filedir\u0027"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY",
"refsource": "MISC",
"url": "https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"
},
{
"name": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384",
"refsource": "MISC",
"url": "https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
}
]
},
"source": {
"defect": [
"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2020-8567",
"datePublished": "2021-01-21T17:09:21.322492Z",
"dateReserved": "2020-02-03T00:00:00",
"dateUpdated": "2024-09-16T18:23:40.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}