CVE-2019-11252: Credential leakage when failing to mount

Q: What is CVE-2019-11252?

CVE-2019-11252 is a vulnerability in the Kubernetes kube-controller-manager that allows credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

Q: How severe is CVE-2019-11252?

CVE-2019-11252 has a severity rating of 6.5, which is considered medium.

Q: Which versions of Kubernetes are affected by CVE-2019-11252?

The Kubernetes kube-controller-manager versions v1.0-v1.17 are affected by CVE-2019-11252.

Q: How can I fix the CVE-2019-11252 vulnerability?

To fix the CVE-2019-11252 vulnerability, you should update Kubernetes to a version that is not affected by the vulnerability.

Q: Where can I find more information about CVE-2019-11252?

You can find more information about CVE-2019-11252 on the GitHub page at: https://github.com/kubernetes/kubernetes/pull/88684

Published Jul 23, 2020

Updated

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

Affected Software

1 affected component

Kubernetes kubernetes>=1.0.0<=1.17.0

Remediation

Patch Available

https://github.com/kubernetes/kubernetes/pull/88684

Event History

Jul 23, 2020

CVE Published

via MITRE·02:47 PM

Data Sourced

via MITRE·02:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-11252?

CVE-2019-11252 is a vulnerability in the Kubernetes kube-controller-manager that allows credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

How severe is CVE-2019-11252?

CVE-2019-11252 has a severity rating of 6.5, which is considered medium.

Which versions of Kubernetes are affected by CVE-2019-11252?