CVE-2023-2878

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

CVE-2023-2878: Insertion of Sensitive Information into Log File

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

CVE-2020-8567

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...

CVE-2020-8568

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...

CVE-2020-8568: Path Traversal: '../filedir'

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...

CVE-2020-8567: Path Traversal: '../filedir'

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...

PT-2021-12792

Name of the Vulnerable Software and Affected Versions: Kubernetes Secrets Store CSI Driver Vault Plugin versions prior to v0.0.6 Kubernetes Secrets Store CSI Driver Azure Plugin versions prior to v0.0.10 Kubernetes Secrets Store CSI Driver GCP Plugin versions prior to v0.2.0 Description: The issu...

PT-2021-12793

Name of the Vulnerable Software and Affected Versions: Kubernetes Secrets Store CSI Driver versions v0.0.15 through v0.0.16 Description: The issue allows an attacker who can modify a SecretProviderClassPodStatus/Status resource to write content to the host filesystem and sync file contents to...