| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/Azure/secrets-store-csi-driver-provider-azure | < 0.0.10all versions | 0.0.10 |
| github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp | < 0.2.0 | 0.2.0 |
| github.com/hashicorp/vault-csi-provider | < 0.0.6all versions | 0.0.6 |
| secret manager provider for secret store csi driver | < 0.2.0 | 0.2.0 |
| vault provider for secrets store csi driver | < 0.0.6 | 0.0.6 |
| azure key vault provider for secrets store csi driver | < 0.0.10 | 0.0.10 |
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free