CVE-2019-11250: Kubernetes client-go logs authorization headers at debug verbosity levels
Kubernetes requires an authentication mechanism to enforce users’ privileges. One method of authentication, bearer tokens, are opaque strings used to associate a user with their having successfully authenticated previously. Any user with possession of this token may masquerade as the original user (the “bearer”) without further authentication.
Within Kubernetes, the bearer token is captured within the hyperkube kube-apiserver system logs at high verbosity levels (--v 10). A malicious user with access to the system logs on such a system could masquerade as any user who has previously logged into the system.
Other sources
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-11250?
The severity of CVE-2019-11250 is medium (6.5).
How can unauthorized users access credentials in CVE-2019-11250?
Unauthorized users can access credentials in CVE-2019-11250 through logs or command output.
Which versions of Kubernetes components are affected by CVE-2019-11250?
Kubernetes components (such as kube-apiserver) prior to v1.16.0 are affected by CVE-2019-11250.
How can I fix CVE-2019-11250?
To fix CVE-2019-11250, you need to upgrade Kubernetes components to v1.16.0 or higher.
Where can I find more information about CVE-2019-11250?
You can find more information about CVE-2019-11250 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-11250), [GitHub](https://github.com/kubernetes/kubernetes/issues/81114), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2019:4052).