Skip to content

Commit 71f5136

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-rcw7-pqfp-735x GHSA-wx3r-v6h7-frjp
1 parent 2c35f01 commit 71f5136

File tree

2 files changed

+132
-0
lines changed

2 files changed

+132
-0
lines changed

‎advisories/github-reviewed/2025/09/GHSA-rcw7-pqfp-735x/GHSA-rcw7-pqfp-735x.json

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rcw7-pqfp-735x",
4+
"modified": "2025-09-05T21:02:44Z",
5+
"published": "2025-09-05T21:02:44Z",
6+
"aliases": [
7+
"CVE-2025-7445"
8+
],
9+
"summary": "secrets-store-sync-controller discloses service account tokens in logs",
10+
"details": "Hello Kubernetes Community,\n\nA security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when there is a specific error marshaling the `parameters` sent to the providers.\n\n### Am I vulnerable?\n\nTo check if tokens are being logged, examine the manager container log:\n\n```bash\nkubectl logs -l 'app.kubernetes.io/part-of=secrets-store-sync-controller' -c manager -f | grep --line-buffered \"csi.storage.k8s.io/serviceAccount.tokens\"\n```\n\n### Affected Versions\n\n- secrets-store-sync-controller < v0.0.2\n\n### How do I mitigate this vulnerability?\n\nUpgrade to secrets-store-sync-controller v0.0.2+\n\n### Fixed Versions\n\n- secrets-store-sync-controller >= v0.0.2\n\n\n### Detection\n\nExamine cloud provider logs for unexpected token exchanges, as well as unexpected access to cloud vault secrets.\n\nIf you find evidence that this vulnerability has been exploited, please contact [[email protected]](https://groups.google.com/)\n\n### Acknowledgements\n\nThis vulnerability was reported by Reem Rotenberg and [Kas Dekel](https://github.com/privmickas) from Microsoft.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "sigs.k8s.io/secrets-store-sync-controller"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.0.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/kubernetes-sigs/secrets-store-sync-controller/security/advisories/GHSA-rcw7-pqfp-735x"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7445"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/kubernetes/kubernetes/issues/133897"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/kubernetes-sigs/secrets-store-sync-controller"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://groups.google.com/g/kubernetes-security-announce/c/NP7cQvQ1aGA"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-532"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-09-05T21:02:44Z",
67+
"nvd_published_at": "2025-09-05T03:15:31Z"
68+
}
69+
}

‎advisories/github-reviewed/2025/09/GHSA-wx3r-v6h7-frjp/GHSA-wx3r-v6h7-frjp.json

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wx3r-v6h7-frjp",
4+
"modified": "2025-09-05T21:00:42Z",
5+
"published": "2025-09-05T21:00:42Z",
6+
"aliases": [
7+
"CVE-2025-58438"
8+
],
9+
"summary": "internetarchive Vulnerable to Directory Traversal in File.download()",
10+
"details": "### Impact\n**What kind of vulnerability is it?**\nThis is a **Critical** severity directory traversal (path traversal) vulnerability in the `File.download()` method of the `internetarchive` library.\n\n**Who is impacted?**\nAll users of the `internetarchive` library versions `< 5.5.1` are impacted. The vulnerability is particularly critical for users on **Windows systems**, but all operating systems are affected.\n\n**Description of the vulnerability:**\nThe vulnerability existed because the `file.download()` method did not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., `../../../../windows/system32/file.txt`) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory.\n\n**Potential Impact:**\nAn attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.\n\n### Patches\n**Has the problem been patched?**\nYes, the problem has been patched.\n\n**What versions should users upgrade to?**\nUsers must upgrade to version **5.5.1** or later.\n\n### Workarounds\nIs there a way for users to fix or remediate the vulnerability without upgrading?\nThere is no direct workaround that does not involve upgrading the library. The vulnerability is in the core logic of the file download process.\n\nThe only alternative for users who absolutely cannot upgrade is to implement their own custom download function that:\n\n1. Manually sanitizes all filenames using a robust method.\n2. Validates that the resolved absolute path of the download target is within the intended directory before writing any files.\n\nHowever, this essentially re-implements the fix and is not recommended. Upgrading to the patched version is the only safe and supported solution.\n\n### References\n\n- [Release Notes for v5.5.1](https://github.com/jjjake/internetarchive/releases/tag/v5.5.1)\n- [Commit with the fix](https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2)\n- **CVE Identifier:** CVE-2025-58438",
11+
"severity": [],
12+
"affected": [
13+
{
14+
"package": {
15+
"ecosystem": "PyPI",
16+
"name": "internetarchive"
17+
},
18+
"ranges": [
19+
{
20+
"type": "ECOSYSTEM",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "5.5.1"
27+
}
28+
]
29+
}
30+
],
31+
"database_specific": {
32+
"last_known_affected_version_range": "<= 5.5.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/jjjake/internetarchive"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/jjjake/internetarchive/releases/tag/v5.5.1"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-22"
57+
],
58+
"severity": "CRITICAL",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2025-09-05T21:00:42Z",
61+
"nvd_published_at": null
62+
}
63+
}

0 commit comments

Comments
 (0)