VDB
Sign up
MEDIUM6.5

GHSA-f4w6-3rh6-6q4q

Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

Quick fix

GHSA-f4w6-3rh6-6q4q — github.com/kubernetes-csi/external-provisioner: upgrade to the fixed version with the command below.

go get github.com/kubernetes-csi/external-provisioner@v0.4.3

Details

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/kubernetes-csi/external-provisioner
Introduced in: 0Fixed in: 0.4.3
Fixgo get github.com/kubernetes-csi/external-provisioner@v0.4.3
Go/github.com/kubernetes-csi/external-provisioner
Introduced in: 1.0.0Fixed in: 1.0.2
Fixgo get github.com/kubernetes-csi/external-provisioner@v1.0.2
Go/github.com/kubernetes-csi/external-provisioner

No fixed version published yet for github.com/kubernetes-csi/external-provisioner (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/kubernetes-csi/external-provisioner
Introduced in: 1.2.0Fixed in: 1.2.2
Fixgo get github.com/kubernetes-csi/external-provisioner@v1.2.2
Go/github.com/kubernetes-csi/external-provisioner
Introduced in: 1.3.0Fixed in: 1.3.1
Fixgo get github.com/kubernetes-csi/external-provisioner@v1.3.1
Go/github.com/kubernetes-csi/external-snapshotter/v6
Introduced in: 1.0.0Fixed in: 1.0.2
Fixgo get github.com/kubernetes-csi/external-snapshotter/v6@v1.0.2
Go/github.com/kubernetes-csi/external-snapshotter/v6

No fixed version published yet for github.com/kubernetes-csi/external-snapshotter/v6 (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/kubernetes-csi/external-snapshotter/v6
Introduced in: 1.2.0Fixed in: 1.2.2
Fixgo get github.com/kubernetes-csi/external-snapshotter/v6@v1.2.2
Go/github.com/kubernetes-csi/external-resizer

No fixed version published yet for github.com/kubernetes-csi/external-resizer (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/kubernetes-csi/external-resizer

No fixed version published yet for github.com/kubernetes-csi/external-resizer (go modules). Pin to a known-safe version or switch to an alternative.

References