Vulnerabilities in pkg:golang/github.com/gardener/gardener-extension-provider-openstack

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-227x-7mh8-3cf6",
  "modified" : "2025-10-23T20:12:12Z",
  "published" : "2025-09-25T16:39:16Z",
  "aliases" : [ "CVE-2025-59823" ],
  "summary" : "Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning",
  "details" : "### Impact\n\nA security vulnerability was discovered in Gardener when [Terraformer](https://github.com/gardener/terraformer) is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed.\n\nThis CVE affects all Gardener installations where [Terraformer](https://github.com/gardener/terraformer) is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below.\n\n### Affected Components\n• gardener-extension-provider-gcp\n• gardener-extension-provider-azure\n• gardener-extension-provider-openstack\n• gardener-extension-provider-aws\n\n### Affected Versions\n• gardener-extension-provider-gcp < v1.46.0\n• gardener-extension-provider-azure < v1.55.0\n• gardener-extension-provider-openstack < v1.49.0\n• gardener-extension-provider-aws < v1.64.0\n\n### Fixed versions\n• gardener-extension-provider-gcp >= v1.46.0\n• gardener-extension-provider-azure >= v1.55.0\n• gardener-extension-provider-openstack >= v1.49.0\n• gardener-extension-provider-aws >= v1.64.0\n\n### How do I mitigate this vulnerability?\nUpdate to a fixed version.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/gardener/gardener-extension-provider-aws"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.64.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/gardener/gardener-extension-provider-gcp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.46.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/gardener/gardener-extension-provider-azure"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.55.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/gardener/gardener-extension-provider-openstack"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.49.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59823"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-azure/commit/4573a4404969f89781ed6cf72e90554bc6ae2020"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-gcp/commit/51111b4f60c33c60dfdf18b1fc50f7ec8d8f70ac"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gardener/gardener-extension-provider-aws"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2025-3981"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-25T16:39:16Z",
    "nvd_published_at" : "2025-09-25T15:16:13Z"
  }
}