Skip to content
CVE PROGRAM SOURCE RECORD4.9 Medium

CVE-2020-8567

Kubernetes Secrets Store CSI Driver plugin directory traversals

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Kubernetes Secrets Store CSI Driver

  • Vault Plugin to < v0.0.6affected
  • Azure Plugin to < v0.0.10affected
  • GCP Plugin to < v0.2.0affected

References