CVE-2020-8565: Unauthorized credential disclosure in k8s.io/kubernetes and k8s.io/client-go
Summary
CVE-2020-8565: Kubernetes client-go vulnerable to Sensitive Information Leak via Log File. Affects k8s.io/client-go across 4 version ranges.
< 0.17.16
>= 0.18.0, < 0.18.14
>= 0.19.0, < 0.19.6
>= 0.20.0-alpha.0, < 0.20.0-alpha.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- github.com/kubernetes/kubernetes · Go
- kubernetes · Debian:11
The same CVE-2020-8565 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The k8s.io/kubernetes and k8s.io/client-go packages are part of the Kubernetes ecosystem written in Go. They provide functionality for managing and orchestrating containerized applications. The k8s.io/client-go package is a client library for interacting with the Kubernetes API, while k8s.io/kubernetes is the core Kubernetes codebase. These packages are widely used in the deployment and management of Kubernetes clusters.
Vulnerability Detail
The vulnerability, identified as CVE-2020-8565, allows unauthorized credential disclosure in the k8s.io/kubernetes and k8s.io/client-go packages. If the verbosity level is set to a debug level, authorization tokens may be inappropriately logged. This could lead to the exposure of sensitive credentials, potentially allowing an attacker to gain unauthorized access to Kubernetes clusters or other systems that rely on these packages.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.17.160.17.16go get k8s.io/client-go@v0.17.16 -
>= 0.18.0, < 0.18.140.18.14go get k8s.io/client-go@v0.18.14 -
>= 0.19.0, < 0.19.60.19.6go get k8s.io/client-go@v0.19.6 -
>= 0.20.0-alpha.0, < 0.20.0-alpha.20.20.0-alpha.2go get k8s.io/client-go@v0.20.0-alpha.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid setting the verbosity level to a debug level. By keeping the verbosity level at a lower level, the risk of unauthorized credential disclosure is mitigated. However, this workaround does not address the underlying vulnerability and should only be considered as a temporary measure until the packages can be updated to the fixed versions.
Conclusion
The unauthorized credential disclosure vulnerability in the k8s.io/kubernetes and k8s.io/client-go packages can lead to the exposure of sensitive credentials and potential unauthorized access. It is crucial to update the affected packages to the fixed versions and avoid setting the verbosity level to a debug level. Additionally, using the Vulert Playground can help identify if your application is affected by this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for k8s.io/client-go →
FAQ
This vulnerability could lead to the exposure of sensitive credentials, potentially allowing an attacker to gain unauthorized access to Kubernetes clusters or other systems that rely on these packages.
The vulnerability affects versions of k8s.io/kubernetes prior to 1.20.0-alpha.2 and versions of k8s.io/client-go prior to 0.20.0-alpha.2.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and Vulert will analyze it in real-time.
There are currently no known exploits for this vulnerability. However, it is important to update the affected packages as soon as possible to prevent potential unauthorized access.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for k8s.io/client-go.
