[BCM 11] CVE-2025-62878: When will Local Path Provisioner be updated to v0.0.34?

Accelerated Computing Base Command Manager
1

Hello,

We are running NVIDIA Base Command Manager (BCM) 11 on Ubuntu 24.04 LTS
in a production environment.

We have identified that the Local Path Provisioner included in BCM 11
(cm-kubernetes-local-path-provisioner, v0.0.32) is affected by
CVE-2025-62878 (CVSS 10.0 - Critical).

This vulnerability allows an authenticated attacker to inject path
traversal sequences via StorageClass path templates, enabling arbitrary
read/write/delete operations on the host filesystem.

The fix is available in Local Path Provisioner v0.0.34, however the
BCM 11 package repository currently only provides v0.0.31 and v0.0.32.

We confirmed this with the following commands:

apt list --all-versions cm-kubernetes-local-path-provisioner

Output:
cm-kubernetes-local-path-provisioner/BCM 11,now 0.0.32-100167-cm11.0-f818be7dd7 amd64 [installed]
cm-kubernetes-local-path-provisioner/BCM 11 0.0.31-100165-cm11.0-db47b752b1 amd64

Questions:

  1. Is NVIDIA aware of CVE-2025-62878 affecting BCM 11?
  2. When will cm-kubernetes-local-path-provisioner v0.0.34 (or later)
    be available in the BCM 11 repository?
  3. Are there any recommended mitigations while waiting for the
    official update?

Thank you.

2

Hi, you probably already knew, v0.0.34 is already available, please upgrade immediately, thanks.