Skip to content
Sign in
5.8 Medium

CVE-2020-8568 Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a…

Description

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

Affected products and versions

Product Affected versions Fixed in
Kubernetes Secrets Store CSI Driver Versions not published

Other CVEs of Kubernetes Secrets Store CSI Driver

The 2 CVEs of Kubernetes Secrets Store CSI Driver →
CVE-2020-8567 Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to… 4.9 Medium
Track this CVE