GO-2024-3126: External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets

external-secrets

command module

v0.7.0-rc1 Latest Latest Go to latest Published: Nov 29, 2022 License: Apache-2.0 Imports: 1 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/external-secrets/external-secrets

README ¶

External Secrets

External Secrets Operator is a Kubernetes operator that integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, Akeyless and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.

Multiple people and organizations are joining efforts to create a single External Secrets solution based on existing projects. If you are curious about the origins of this project, check out this issue and this PR.

Documentation

External Secrets Operator guides and reference documentation is available at external-secrets.io. Also see our stability and support policy.

Contributing

We welcome and encourage contributions to this project! Please read the Developer and Contribution process guides. Also make sure to check the Code of Conduct and adhere to its guidelines.

Sponsoring

Please consider sponsoring this project, there are many ways you can help us with: engineering time, providing infrastructure, donating money, etc. We are open to cooperations, feel free to approach as and we discuss how this could look like. We can keep your contribution anonymized if that's required (depending on the type of contribution), and anonymous donations are possible inside Opencollective.

Bi-weekly Development Meeting

We host our development meeting every odd wednesday at 5:30 PM Berlin Time on Jitsi. Meeting notes are recorded on hackmd.

Anyone is welcome to join. Feel free to ask questions, request feedback, raise awareness for an issue, or just say hi. ;)

Security

Please report vulnerabilities by email to contact@external-secrets.io. Also see our SECURITY.md file for details.

software bill of materials

We attach SBOM and provenance file to our GitHub release. Also, they are attached to container images.

Adopters

Please create a PR and add your company or project to our ADOPTERS.md file if you are using our project!

Roadmap

You can find the roadmap in our documentation: https://external-secrets.io/main/contributing/roadmap/

Kicked off by

Documentation ¶

Overview ¶

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Source Files ¶

View all Source files

main.go

Directories ¶

Path	Synopsis
apis
externalsecrets
externalsecrets/v1alpha1 Package v1alpha1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1alpha1	Package v1alpha1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1alpha1
externalsecrets/v1beta1 Package v1beta1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1beta1	Package v1beta1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1beta1
externalsecrets/v1beta1/fakes Code generated by counterfeiter.	Code generated by counterfeiter.
generators/v1alpha1 Package v1alpha1 contains resources for generators +kubebuilder:object:generate=true +groupName=generators.external-secrets.io +versionName=v1alpha1	Package v1alpha1 contains resources for generators +kubebuilder:object:generate=true +groupName=generators.external-secrets.io +versionName=v1alpha1
meta Package meta contains meta types for external-secret APIs.	Package meta contains meta types for external-secret APIs.
meta/v1 Package meta contains meta types for external-secrets APIs +kubebuilder:object:generate=true	Package meta contains meta types for external-secrets APIs +kubebuilder:object:generate=true
cmd
pkg
controllers/clusterexternalsecret
controllers/commontest
controllers/crds
controllers/externalsecret Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
controllers/pushsecret
controllers/secretstore Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
controllers/webhookconfig
find
generator/acr
generator/ecr
generator/fake
generator/gcr
generator/password
generator/register
provider/akeyless Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/akeyless/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/alibaba
provider/alibaba/fake
provider/aws
provider/aws/auth Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/auth/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/parameterstore Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/parameterstore/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/secretsmanager
provider/aws/secretsmanager/fake
provider/aws/util Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/azure/keyvault
provider/azure/keyvault/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/doppler
provider/doppler/client
provider/doppler/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/fake
provider/gcp/secretmanager Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/gcp/secretmanager/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/gitlab Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/gitlab/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/ibm Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/ibm/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/kubernetes Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/onepassword Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/onepassword/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/oracle Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/oracle/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/register
provider/senhasegura
provider/senhasegura/auth
provider/senhasegura/dsm
provider/testing/fake
provider/util/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/vault
provider/vault/fake
provider/webhook
provider/yandex/certificatemanager Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/certificatemanager/client Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/common Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/common/clock Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/lockbox Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/lockbox/client Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
template Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
template/v1 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
template/v2 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
utils

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL