# k8s.io/client-go (Go) vulnerabilities

3 known vulnerabilities (2 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/k8s.io/client-go

## Advisories (3)

### [CVE-2020-8565](https://cve.now/CVE-2020-8565): Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \>= 9

- Severity: Medium 4.7
- Published: Dec 7, 2020
- Affected: fixed in 0.20.0-alpha.2; from 0.19.0, fixed in 0.19.6; from 0.20.0-alpha.0, fixed in 0.20.0-alpha.2; from 0.18.0, fixed in 0.18.14; fixed in 0.17.16.

### [CVE-2019-11250](https://cve.now/CVE-2019-11250): Kubernetes client-go logs authorization headers at debug verbosity levels

- Severity: Medium 4.7
- Published: Aug 29, 2019
- Affected: fixed in 0.17.0.

### [CVE-2019-11244](https://cve.now/CVE-2019-11244): kubectl creates world-writeable cached schema files

- Severity: Low 3.3
- Published: Apr 22, 2019
- Affected: from 1.8.0, fixed in 1.12.9.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/k8s.io/client-go
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.