CVE-2020-8568

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

Score

CVSS 3.1 6.5 Medium

Status

Modified - jordan@liggitt.net

Published

2021-01-21

Last modified

2024-09-17

Weaknesses

CWE-20, CWE-22, CWE-24

Affected products

• Kubernetes Secrets Store Csi Driver (Kubernetes)
• Secrets Store Csi Driver (Kubernetes)

References

• https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378
• https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4