CVE-2020-8564: Sensitive information leak via log file in k8s.io/kubernetes
Summary
CVE-2020-8564: Kubernetes Sensitive Information leak via Log File. Affects github.com/kubernetes/kubernetes across 3 version ranges.
< 1.17.13
>= 1.18.0, < 1.18.10
>= 1.19.0, < 1.19.3
Fixed in 1.17.13, 1.18.10 or 1.19.3, depending on the release line you run. How to fix ↓
Also tracked for
- k8s.io/kubernetes · Go
- kubernetes · Debian:11
The same CVE-2020-8564 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
k8s.io/kubernetes is a Go package that provides a platform for automating deployment, scaling, and management of containerized applications. It is widely used in the Kubernetes ecosystem for managing container orchestration. This package includes functionality for reading and handling Docker configuration files (.dockercfg).
Vulnerability Detail
The vulnerability (CVE-2020-8564) arises when a malformed .dockercfg file is read by the package. This can lead to sensitive information, such as secrets, being inappropriately logged. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data, compromising the security of the system. The issue has been identified and tracked as GO-2021-0066 in the Go vulnerability database.
How To Fix
Latest published version: v1.14.10 as of 23 Oct 2026
go get github.com/kubernetes/kubernetes@v1.14.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.17.131.17.13go get github.com/kubernetes/kubernetes@v1.17.13 -
>= 1.18.0, < 1.18.101.18.10go get github.com/kubernetes/kubernetes@v1.18.10 -
>= 1.19.0, < 1.19.31.19.3go get github.com/kubernetes/kubernetes@v1.19.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to follow secure coding practices and avoid using malformed .dockercfg files.
Conclusion
In conclusion, the vulnerability (CVE-2020-8564) in the k8s.io/kubernetes package allows for sensitive information leakage via log files. It is crucial to update to the fixed version of the package (1.20.0-alpha.1 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/kubernetes/kubernetes →
FAQ
k8s.io/kubernetes is a Go package used for managing container orchestration in the Kubernetes ecosystem.
The vulnerability allows for sensitive information, such as secrets, to be inappropriately logged, potentially leading to unauthorized access and compromise of the system.
To fix this vulnerability, update the k8s.io/kubernetes package to version 1.20.0-alpha.1 or later.
There are no specific workarounds mentioned for this vulnerability. Following secure coding practices and avoiding the use of malformed .dockercfg files is recommended.
More information about this vulnerability can be found in the Go vulnerability database under the ID GO-2021-0066.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kubernetes/kubernetes.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
