CVE-2020-8568: Kubernetes Secrets Store CSI Driver sync/rotate directory traversal
First published: Thu Jan 21 2021(Updated: )
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a `SecretProviderClassPodStatus/Status` resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under `var/lib/kubelet/pods` that contain other Kubernetes Secrets. ### Specific Go Packages Affected sigs.k8s.io/secrets-store-csi-driver/controllers sigs.k8s.io/secrets-store-csi-driver/pkg/rotation sigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store
Credit: jordan@liggitt.net jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/sigs.k8s.io/secrets-store-csi-driver | >=0.0.15<0.0.17 | 0.0.17 |
| Kubernetes Secrets Store CSI Driver | =0.0.15 | |
| Kubernetes Secrets Store CSI Driver | =0.0.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-8568
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/pull/371
- https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/commit/c2cbb19e2eef16638fa0523383788a4bc22231fd
- https://pkg.go.dev/vuln/GO-2022-0629
- https://github.com/advisories/GHSA-5cgx-vhfp-6cf9 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-8568.
What is the severity of CVE-2020-8568?
The severity of CVE-2020-8568 is medium with a CVSS score of 6.5.
Which versions of Kubernetes Secrets Store CSI Driver are affected by CVE-2020-8568?
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 are affected by CVE-2020-8568.
How can an attacker exploit CVE-2020-8568?
An attacker who can modify a SecretProviderClassPodStatus/Status resource can exploit CVE-2020-8568 to write content to the host filesystem and sync file contents to Kubernetes Secrets.
What is the remedy for CVE-2020-8568?
The remedy for CVE-2020-8568 is to update to version 0.0.17 of Kubernetes Secrets Store CSI Driver.
- collector/github-advisory-latest
- alias/GHSA-5cgx-vhfp-6cf9
- alias/CVE-2020-8568
- collector/github-advisory
- agent/author
- agent/type
- agent/remedy
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- package-manager/go
- vendor/kubernetes
- canonical/kubernetes secrets store csi driver
- version/kubernetes secrets store csi driver/0.0.15
- version/kubernetes secrets store csi driver/0.0.16