CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: policy-controller, buildkitd, flyte, flux, chezmoi, timestamp-authority, py3-cassandra-medusa, argo-events, sops, trivy, rekor, cortex, spire-server, py3-azure-identity, flux-source-controller, trino, restic, fluent-bit-plugin-loki, zarf, druid, argo-workflows,...

GO-2024-2750 Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure

Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: ollama, k3s, timestamp-authority, kube-state-metrics, certificate-transparency, cortex, buf, aws-load-balancer-controller, kubeflow, kyverno-policy-reporter-ui, gitsign, sigstore-scaffolding, dagger, minio, terraform-provider-aws, dex, terraform-docs,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: falcosidekick, sigstore-scaffolding, gotenberg, dynamic-localpv-provisioner, cloud-sql-proxy-fips, crossplane-provider-aws-elasticache, kube-rbac-proxy-fips, flux-image-reflector-controller, kine, kubewatch, argo-workflows, kpt, crossplane-provider-aws-lambda, kwok,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: falcosidekick, sigstore-scaffolding, gotenberg, dynamic-localpv-provisioner, cloud-sql-proxy-fips, crossplane-provider-aws-elasticache, kube-rbac-proxy-fips, flux-image-reflector-controller, kine, kubewatch, argo-workflows, kpt, crossplane-provider-aws-lambda, kwok,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: timestamp-authority-fips, aws-efs-csi-driver-fips, kube-oidc-proxy, aactl, dgraph, plutono-fips, spark-operator, prometheus-stackdriver-exporter, kubeflow, kubernetes-csi-livenessprobe-fips, cortex, slsa-verifier, bank-vaults-fips, conftest-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, aactl, buildkitd, kubeflow, src, spark-operator, scorecard, terraform-provider-sendgrid, up, k3d, dgraph, kubescape, cortex, slsa-verifier...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: kube-logging-logging-operator, kubeflow-katib, crossplane-provider-azure, gke-gcloud-auth-plugin, sigstore-scaffolding, flux-helm-controller, flux-kustomize-controller, gitness, dynamic-localpv-provisioner, slsa-verifier, caddy, prometheus-mysqld-exporter,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kube-logging-logging-operator, kubeflow-katib, crossplane-provider-azure, gke-gcloud-auth-plugin, sigstore-scaffolding, flux-helm-controller, flux-kustomize-controller, gitness, dynamic-localpv-provisioner, slsa-verifier, caddy, prometheus-mysqld-exporter,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: ollama, git-lfs, certificate-transparency, cortex, kubeflow, sigstore-scaffolding, minio, terraform-provider-aws, dex, fuse-overlayfs-snapshotter, hugo, terraform-provider-azurerm, pulumi-language-java, conftest, kind, aactl, stakater-reloader, pulumi-language-dotnet...

The vulnerability of the secrets-store-csi-driver driver of the Kubernetes cluster management software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the secrets-store-csi-driver driver in the Kubernetes cluster management software is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Insertion Of Sensitive Information Into Log File

sigs.k8s.io/secrets-store-csi-driver is vulnerable to Insertion of Sensitive Information Into Log File. An attacker with access to the driver logs could observe service account tokens due to the NodePublishVolume function of nodeserver.go...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

CVE-2023-2878

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: vault-csi-provider, secrets-store-csi-driver...

CVE-2023-2878

CVE-2023-2878 affects Kubernetes secrets-store-csi-driver. The vulnerability occurs in versions before 1.3.3, where the driver discloses service account tokens in logs. This could allow an attacker with local access or log access to read leaked tokens, enabling impersonation of the associated ser...

CVE-2023-2878 Kubernetes secrets-store-csi-driver discloses service account tokens in logs

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

CVE-2023-2878: Insertion of Sensitive Information into Log File

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs...

Kubernetes 日志信息泄露漏洞

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes secrets-store-csi-driver versions prior to 1.3.3 that stems from exposing service...

secrets-store-csi-driver discloses service account tokens in logs

A security issue was discovered in secrets-store-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged...