CVE-2020-8567 – Kubernetes Secrets Store CSI Driver plugin directory traversals

https://notcve.org/view.php?id=CVE-2020-8567

21 Jan 2021 — Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods. Kubernetes Secrets Store CSI Driver Vault Plugin anterior a versión v0.0.6, Azure Plugin anterior a versión v0.0.10 y GCP Plugin anterior a versión v0.2.0, permiten a un atacante que puede crear objetos SecretProvid... • https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-24: Path Traversal: '../filedir' •