CVE-2023-2878

Summary

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.

Affected Software

Weaknesses

• CWE-532: CWE-532 Insertion of Sensitive Information into Log File

Workarounds

Prior to upgrading, this vulnerability can be mitigated by running secrets-store-csi-driver at log level 0 or 1 via the -v flag.

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/kubernetes/kubernetes/issues/118419
• https://groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJ
• https://security.netapp.com/advisory/ntap-20230814-0003/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/kubernetes/kubernetes/issues/118419
• https://groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJ
• https://security.netapp.com/advisory/ntap-20230814-0003/

• ←Previous
• Next→