CVE-2020-8567
Medium
Description
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
SeverityMedium
CVSS4.9
Exploit probability—
Product
Google Secret Manager Provider For Secret Store Csi Driver
PublishedJan 21, 2021
First seenJan 21, 2021
Weakness typeCWE-24CWE-24
How to fix
Update
- google secret_manager_provider_for_secret_store_csi_driver0.2.0 or later
- hashicorp vault_provider_for_secrets_store_csi_driver0.0.6 or later
- microsoft azure_key_vault_provider_for_secrets_store_csi_driver0.0.10 or later
- github.com/hashicorp/vault-csi-provider0.0.6 or later
- github.com/Azure/secrets-store-csi-driver-provider-azure0.0.10 or later
- github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp0.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google secret_manager_provider_for_secret_store_csi_driver | v < 0.2.0 | 0.2.0 |
| hashicorp vault_provider_for_secrets_store_csi_driver | v < 0.0.6 | 0.0.6 |
| microsoft azure_key_vault_provider_for_secrets_store_csi_driver | v < 0.0.10 | 0.0.10 |
| github.com/hashicorp/vault-csi-providerGo | v < 0.0.6, No range specified | 0.0.6 |
| github.com/Azure/secrets-store-csi-driver-provider-azureGo | v < 0.0.10, No range specified | 0.0.10 |
| github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcpGo | v < 0.2.0 | 0.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.