{"action":"Upgrade sigs.k8s.io/aws-iam-authenticator to 0.5.9 or later.","affected":[{"fixed":"0.5.9","introduced":"0"}],"component":"sigs.k8s.io/aws-iam-authenticator","cve_ids":["CVE-2022-2385"],"ecosystem":"Go","epss":0.01101,"exploited":false,"fixed_versions":["0.5.9"],"ghsa_id":"GHSA-pp3f-98qg-5g75","id":"tcs_01M5KFHKPW73887JG7G50WT69Y","modified_at":"2024-08-21T15:42:04.700985Z","published_at":"2022-07-13T00:00:41Z","references":["https://osv.dev/vulnerability/GHSA-pp3f-98qg-5g75","https://nvd.nist.gov/vuln/detail/CVE-2022-2385","https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472","https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/469","https://github.com/kubernetes-sigs/aws-iam-authenticator/commit/029d1dcf2ec8d662d9b1c21260bb197404bc8218","https://github.com/kubernetes-sigs/aws-iam-authenticator","https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v0.5.9","https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYs"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-pp3f-98qg-5g75","url":"https://osv.dev/vulnerability/GHSA-pp3f-98qg-5g75"}],"summary":"aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9"}