CVE-2020-8565GO-2021-0064GHSA-8CFG-VX93-JVXW
Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.20.0-alpha2, 0.20.0-alpha.2, 0.19.6, 0.18.14, 0.17.16, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
Timeline
- CVE published
- Record last updated
Affected versions
- Kubernetes Kubernetes
through 1.19.3; through 1.18.10; through 1.17.13; fixed in 1.20.0-alpha2
- k8s.io/client-goGo
fixed in 0.20.0-alpha.2
- k8s.io/client-goGo
From 0.19.0 · fixed in 0.19.6
- k8s.io/client-goGo
From 0.20.0-alpha.0 · fixed in 0.20.0-alpha.2
- k8s.io/client-goGo
From 0.18.0 · fixed in 0.18.14
- k8s.io/client-goGo
fixed in 0.17.16
- k8s.io/kubernetesGo
fixed in 1.20.0-alpha.2