GitStock

gardener/gardener-extension-provider-aws · Security

Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

GHSA ID
GHSA-227x-7mh8-3cf6
CVE ID
CVE-2025-59823
Severity
critical
Published
Updated
CVSS
9.9 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v3
9.9 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

Impact

A security vulnerability was discovered in Gardener when Terraformer is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed.

This CVE affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below.

Affected Components

• gardener-extension-provider-gcp • gardener-extension-provider-azure • gardener-extension-provider-openstack • gardener-extension-provider-aws

Affected Versions

• gardener-extension-provider-gcp < v1.46.0 • gardener-extension-provider-azure < v1.55.0 • gardener-extension-provider-openstack < v1.49.0 • gardener-extension-provider-aws < v1.64.0

Fixed versions

• gardener-extension-provider-gcp >= v1.46.0 • gardener-extension-provider-azure >= v1.55.0 • gardener-extension-provider-openstack >= v1.49.0 • gardener-extension-provider-aws >= v1.64.0

How do I mitigate this vulnerability?

Update to a fixed version.

CWEs

  • CWE-20 · Improper Input Validation
  • CWE-94 · Improper Control of Generation of Code ('Code Injection')

References

Open GitHub