—
GO-2025-3981
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
Quick fix
GO-2025-3981 — github.com/gardener/gardener-extension-provider-aws: upgrade to the fixed version with the command below.
go get github.com/gardener/gardener-extension-provider-aws@v1.64.0Details
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/gardener/gardener-extension-provider-aws
Introduced in:
0Fixed in: 1.64.0Fix
go get github.com/gardener/gardener-extension-provider-aws@v1.64.0Go/github.com/gardener/gardener-extension-provider-azure
Introduced in:
0Fixed in: 1.55.0Fix
go get github.com/gardener/gardener-extension-provider-azure@v1.55.0Go/github.com/gardener/gardener-extension-provider-gcp
Introduced in:
0Fixed in: 1.46.0Fix
go get github.com/gardener/gardener-extension-provider-gcp@v1.46.0Go/github.com/gardener/gardener-extension-provider-openstack
Introduced in:
0Fixed in: 1.49.0Fix
go get github.com/gardener/gardener-extension-provider-openstack@v1.49.0References
- https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2025-59823[ADVISORY]
- https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2[FIX]
- https://github.com/gardener/gardener-extension-provider-azure/commit/4573a4404969f89781ed6cf72e90554bc6ae2020[FIX]
- https://github.com/gardener/gardener-extension-provider-gcp/commit/51111b4f60c33c60dfdf18b1fc50f7ec8d8f70ac[FIX]
- https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8[FIX]
- https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0[WEB]
- https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0[WEB]
- https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0[WEB]
- https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0[WEB]