← All advisories

Moderate severityNVD Advisory· Published Jun 7, 2023· Updated Feb 13, 2025

Kubernetes secrets-store-csi-driver discloses service account tokens in logs

CVE-2023-2878

Description

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
sigs.k8s.io/secrets-store-csi-driverGo	< 1.3.3	1.3.3

Affected products

10

osv-coords9 versions
pkg:apk/chainguard/secrets-store-csi-driver pkg:apk/chainguard/secrets-store-csi-driver-crds pkg:apk/chainguard/vault-csi-provider pkg:apk/chainguard/vault-csi-provider-compat pkg:apk/wolfi/secrets-store-csi-driver pkg:apk/wolfi/secrets-store-csi-driver-crds pkg:apk/wolfi/vault-csi-provider pkg:apk/wolfi/vault-csi-provider-compat pkg:golang/sigs.k8s.io/secrets-store-csi-driver
< 1.3.3-r0+ 8 more
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.4.0-r9
- (no CPE)range: < 1.4.0-r9
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.4.0-r9
- (no CPE)range: < 1.4.0-r9
- (no CPE)range: < 1.3.3
Kubernetes/secrets-store-csi-driverv5
Range: 0

Patches

Vulnerability mechanics

References

8

github.com/advisories/GHSA-g82w-58jf-gcxxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-2878ghsaADVISORY
github.com/kubernetes-sigs/secrets-store-csi-driver/releases/tag/v1.3.3ghsaWEB
github.com/kubernetes-sigs/secrets-store-csi-driver/security/advisories/GHSA-g82w-58jf-gcxxghsaWEB
github.com/kubernetes/kubernetes/issues/118419ghsaissue-trackingWEB
groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJghsamailing-listWEB
security.netapp.com/advisory/ntap-20230814-0003ghsaWEB
security.netapp.com/advisory/ntap-20230814-0003/mitre

News mentions

0

No linked articles in our index yet.