CVE-2020-8563: Sensitive Information leak via Log File in Kubernetes
Summary
CVE-2020-8563: Sensitive Information leak via Log File in Kubernetes. Affects github.com/kubernetes/kubernetes versions < 1.19.3. Fixed in 1.19.3. How to fix ↓
Also tracked for
- k8s.io/kubernetes · Go
The same CVE-2020-8563 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. It is written in Go and widely used in cloud-native environments. The vulnerability identified as CVE-2020-8563 affects Kubernetes clusters using VSphere as a cloud provider. When the logging level is set to 4 or above, the VSphere cloud credentials are leaked in the cloud controller manager's log. This vulnerability impacts Kubernetes versions prior to v1.19.3.
Vulnerability Detail
The vulnerability arises due to the improper handling of logging in Kubernetes clusters using VSphere as a cloud provider. When the logging level is set to 4 or above, the cloud controller manager's log includes the VSphere cloud credentials. This sensitive information leak can lead to unauthorized access to the cloud provider, compromising the security and integrity of the cluster. The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.19.3
This is the first release that contains the fix.
go get github.com/kubernetes/kubernetes@v1.19.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Kubernetes is not immediately feasible, a temporary workaround is to lower the logging level to below 4. By setting the logging level to a lower value, the VSphere cloud credentials will not be included in the cloud controller manager's log. However, this workaround should be considered temporary, and upgrading to the fixed version is strongly recommended.
Conclusion
The vulnerability CVE-2020-8563 in Kubernetes exposes VSphere cloud credentials in the cloud controller manager's log. To mitigate this issue, it is crucial to upgrade Kubernetes to version 1.19.3 or above. Lowering the logging level can serve as a temporary workaround, but upgrading to the fixed version is highly recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kubernetes/kubernetes →
FAQ
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications.
VSphere is a cloud computing virtualization platform provided by VMware. It enables the virtualization of physical servers and the management of virtual machines.
The vulnerability allows for the leakage of VSphere cloud credentials in the cloud controller manager's log. This can lead to unauthorized access to the cloud provider, compromising the security and integrity of the Kubernetes cluster.
To fix this vulnerability, it is recommended to upgrade Kubernetes to version 1.19.3 or above. This version includes the necessary fixes to prevent the leakage of VSphere cloud credentials in the cloud controller manager's log.
Yes, a temporary workaround is to lower the logging level to below 4. By setting the logging level to a lower value, the VSphere cloud credentials will not be included in the cloud controller manager's log. However, upgrading to the fixed version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kubernetes/kubernetes.
