GO-2024-3126: External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets

external-secrets

command module

v0.5.5 Latest Latest Go to latest Published: May 31, 2022 License: Apache-2.0 Imports: 1 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/external-secrets/external-secrets

Links

Open Source Insights

README ¶

External Secrets

External Secrets Operator is a Kubernetes operator that integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.

Multiple people and organizations are joining efforts to create a single External Secrets solution based on existing projects. If you are curious about the origins of this project, check out this issue and this PR.

Documentation

External Secrets Operator guides and reference documentation is available at external-secrets.io. Also see our stability and support policy.

Contributing

We welcome and encourage contributions to this project! Please read the Developer and Contribution process guides. Also make sure to check the Code of Conduct and adhere to its guidelines.

Sponsoring

Please consider sponsoring this project, there are many ways you can help us with: engineering time, providing infrastructure, donating money, etc. We are open to cooperations, feel free to approach as and we discuss how this could look like. We can keep your contribution anonymized if that's required (depending on the type of contribution), and anonymous donations are possible inside Opencollective.

Bi-weekly Development Meeting

We host our development meeting every odd wednesday at 5:30 PM Berlin Time on Jitsi. Meeting notes are recorded on hackmd.

Anyone is welcome to join. Feel free to ask questions, request feedback, raise awareness for an issue or just say hi ;)

Security

Please report vulnerabilities by email to contact@external-secrets.io, also see our security policy for details.

Adopters

Please create a PR and add your company or your project to our ADOPTERS file if you are using our project!

Kicked off by

Documentation ¶

Overview ¶

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Source Files ¶

View all Source files

main.go

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
apis
externalsecrets
externalsecrets/v1alpha1 Package v1alpha1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1alpha1	Package v1alpha1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1alpha1
externalsecrets/v1beta1 Package v1beta1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1beta1 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Package v1beta1 contains resources for external-secrets +kubebuilder:object:generate=true +groupName=external-secrets.io +versionName=v1beta1 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
meta Package meta contains meta types for external-secret APIs.	Package meta contains meta types for external-secret APIs.
meta/v1 Package meta contains meta types for external-secrets APIs +kubebuilder:object:generate=true	Package meta contains meta types for external-secrets APIs +kubebuilder:object:generate=true
cmd
e2e
framework Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
framework/addon Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
framework/log Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
framework/util Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/argocd
suites/flux
suites/provider/cases Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/akeyless
suites/provider/cases/alibaba
suites/provider/cases/aws Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/aws/parameterstore Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/aws/secretsmanager
suites/provider/cases/azure Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/common Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/gcp Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/gitlab Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/oracle Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/template Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
suites/provider/cases/vault Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
pkg
controllers/clusterexternalsecret
controllers/commontest
controllers/crds
controllers/externalsecret Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
controllers/secretstore Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
controllers/webhookconfig
find
provider/akeyless Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/akeyless/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/alibaba
provider/alibaba/fake
provider/aws
provider/aws/auth Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/auth/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/parameterstore Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/parameterstore/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/aws/secretsmanager
provider/aws/secretsmanager/fake
provider/aws/util Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/azure/keyvault
provider/azure/keyvault/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/fake
provider/gcp/secretmanager Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/gcp/secretmanager/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/gitlab Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/gitlab/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/ibm Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/ibm/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/kubernetes
provider/onepassword Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/onepassword/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/oracle Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/oracle/fake Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/register
provider/senhasegura
provider/senhasegura/auth
provider/senhasegura/dsm
provider/testing/fake
provider/vault
provider/vault/fake
provider/webhook
provider/yandex/certificatemanager Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/certificatemanager/client Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/common Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/common/clock Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/lockbox Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
provider/yandex/lockbox/client Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
template Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
template/v1 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
template/v2 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.	Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
utils