CVE-2020-8567

2021-01-2117:15:14

Google

osv.dev

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.9%

JSON

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

CPENameOperatorVersion
secrets-store-csi-driver-provider-azureeq0.0.13
secrets-store-csi-driver-provider-azureeq0.0.7
secrets-store-csi-driver-provider-azureeq0.0.22
secrets-store-csi-driver-provider-azureeq0.0.15
secrets-store-csi-driver-provider-azureeq0.0.6
secrets-store-csi-driver-provider-azureeq0.0.11
secrets-store-csi-driver-provider-azureeq0.0.14
secrets-store-csi-driver-provider-azureeq0.0.16
secrets-store-csi-driver-provider-azureeq0.0.3
secrets-store-csi-driver-provider-azureeq0.0.2

Name	Operator	Version
secrets-store-csi-driver-provider-azure	eq	0.0.13
secrets-store-csi-driver-provider-azure	eq	0.0.7
secrets-store-csi-driver-provider-azure	eq	0.0.22
secrets-store-csi-driver-provider-azure	eq	0.0.15
secrets-store-csi-driver-provider-azure	eq	0.0.6
secrets-store-csi-driver-provider-azure	eq	0.0.11
secrets-store-csi-driver-provider-azure	eq	0.0.14
secrets-store-csi-driver-provider-azure	eq	0.0.16
secrets-store-csi-driver-provider-azure	eq	0.0.3
secrets-store-csi-driver-provider-azure	eq	0.0.2