GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, nri-prometheus, hugo, terraform-provider-aws, minio, amass, secrets-store-csi-driver, terraform, kubescape, envoy-ratelimit, fuse-overlayfs-snapshotter, spark-operator, pulumi-language-dotnet, frp, kind, pulumi-language-yaml, mc, slsa-verifier,...

AZL-31305 CVE-2023-44487 affecting package csi-driver-lvm for versions less than 0.4.1-13

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

GHSA-CGCV-5272-97PR vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver...

CVE-2023-2728 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver...

GHSA-XC8M-28VV-4PJC vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver...

CVE-2023-2431 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver...

Insertion Of Sensitive Information Into Log File

sigs.k8s.io/secrets-store-csi-driver is vulnerable to Insertion of Sensitive Information Into Log File. An attacker with access to the driver logs could observe service account tokens due to the NodePublishVolume function of nodeserver.go...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

CVE-2023-2878

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver, vault-csi-provider...

CVE-2023-2878

CVE-2023-2878 affects Kubernetes secrets-store-csi-driver. The vulnerability occurs in versions before 1.3.3, where the driver discloses service account tokens in logs. This could allow an attacker with local access or log access to read leaked tokens, enabling impersonation of the associated ser...

CVE-2023-2878 Kubernetes secrets-store-csi-driver discloses service account tokens in logs

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

secrets-store-csi-driver discloses service account tokens in logs

A security issue was discovered in secrets-store-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged...

CVE-2023-2878

A flaw was found in the Kubernetes Secrets Store CSI Driver that could allow a local authenticated attacker to obtain sensitive information, caused by the storage of sensitive information in the log file. By gaining access to the log file, an attacker could obtain service account tokens informati...

SUSE CVE-2023-2878

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

GHSA-G82W-58JF-GCXX vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver, vault-csi-provider...

GHSA-G82W-58JF-GCXX vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

secrets-store-csi-driver discloses service account tokens in logs

A security issue was discovered in secrets-store-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged...

PT-2023-3262 · Kubernetes · Secrets-Store-Csi-Driver

Name of the Vulnerable Software and Affected Versions: secrets-store-csi-driver versions prior to 1.3.3 Description: The issue is related to insufficient protection of registration data in the secrets-store-csi-driver component of Kubernetes. This can allow an attacker to gain unauthorized access...

CVE-2022-46174

A potential race condition issue exists within the Amazon EFS mount helper in efs-utils and aws-efs-csi-driver when using TLS to mount file systems. The mount helper allocates a local port for stunnel to receive NFS connections prior to applying the TLS tunnel. In affected versions, concurrent...