PT-2025-39386 · Google+4 · Gcp Providers+5

CVE-2025-59823 · Publicado 2025-09-25 · Atualizado 2025-10-27

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Gardener versions prior to 1.64.0 (AWS providers) Project Gardener versions prior to 1.55.0 (Azure providers) Project Gardener versions prior to 1.49.0 (OpenStack providers) Project Gardener versions prior to 1.46.0 (GCP providers)

Description Project Gardener, a system for automated Kubernetes cluster management, may allow code injection in its extensions for AWS, Azure, OpenStack, and GCP providers. This could allow a user with administrative privileges for a Gardener project to gain control over the seed cluster managing the shoot cluster. The issue affects Gardener installations utilizing Terraformer for infrastructure provisioning with any of the affected components.

Recommendations Update Gardener Extensions for AWS providers to version 1.64.0 or later. Update Gardener Extensions for Azure providers to version 1.55.0 or later. Update Gardener Extensions for OpenStack providers to version 1.49.0 or later. Update Gardener Extensions for GCP providers to version 1.46.0 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-20

CWE-94

Identificadores relacionados

BDU:2026-00668

CVE-2025-59823

GHSA-227X-7MH8-3CF6

GO-2025-3981

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Produtos afetados

Aws Providers

Azure Providers

Gcp Providers

Openstack Providers

Project Gardener

Terraformer

Referências · 59

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59823.json · Exploit
• https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6 · Nota
• https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0 · Nota
• https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2 · Nota
• https://github.com/gardener/gardener-extension-provider-aws · Nota
• https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0 · Nota
• https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8 · Nota
• https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0 · Nota
• https://github.com/gardener/gardener-extension-provider-gcp/commit/51111b4f60c33c60dfdf18b1fc50f7ec8d8f70ac · Nota
• https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0 · Nota
• https://github.com/gardener/gardener-extension-provider-azure/commit/4573a4404969f89781ed6cf72e90554bc6ae2020 · Nota
• https://suse.com/security/cve/CVE-2025-59347 · Nota
• https://suse.com/security/cve/CVE-2025-9081 · Nota
• https://suse.com/security/cve/CVE-2025-59349 · Nota
• https://suse.com/security/cve/CVE-2025-59531 · Nota