| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/gardener/gardener-extension-provider-aws | < 1.64.0 | 1.64.0 |
| github.com/gardener/gardener-extension-provider-azure | < 1.55.0 | 1.55.0 |
| github.com/gardener/gardener-extension-provider-gcp | < 1.46.0 | 1.46.0 |
| github.com/gardener/gardener-extension-provider-openstack | < 1.49.0 | 1.49.0 |
A security vulnerability was discovered in Gardener when Terraformer is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed.
This CVE affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below.
• gardener-extension-provider-gcp • gardener-extension-provider-azure • gardener-extension-provider-openstack • gardener-extension-provider-aws
• gardener-extension-provider-gcp < v1.46.0 • gardener-extension-provider-azure < v1.55.0 • gardener-extension-provider-openstack < v1.49.0 • gardener-extension-provider-aws < v1.64.0
• gardener-extension-provider-gcp >= v1.46.0 • gardener-extension-provider-azure >= v1.55.0 • gardener-extension-provider-openstack >= v1.49.0 • gardener-extension-provider-aws >= v1.64.0
Update to a fixed version.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free