CVE-2020-8563: Secret leaks in logs for vSphere Provider kube-controller-manager
A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.
Other sources
In Kubernetes clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.
Upstream Fix:
https://github.com/kubernetes/kubernetes/pull/95236
— Red Hat
In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.6.0-202012051246.p0.git.94231.efc9027.el8 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.3 - Upgrade
Upgrade
go/github.com/kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.3 - Upgrade
Upgrade
kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in v1.19.3 - Configuration
Set the logging level below 4 for vSphere-backed clusters. In OCP, use the operator configuration; "Debug" equals level 4 and the default "Normal" equals level 2.
Kubernetes kube-controller-manager logging level = below 4 - Compensating control
Protect cluster logs from unauthorized access.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-8563?
The severity of CVE-2020-8563 is medium with a CVSS score of 6.3.
How does CVE-2020-8563 affect Kubernetes clusters?
CVE-2020-8563 affects Kubernetes clusters running on VSphere, using VSphere as a cloud provider with a logging level set to 4 or above.
What information is leaked in the cloud controller manager's log in CVE-2020-8563?
In CVE-2020-8563, VSphere cloud credentials are leaked in the cloud controller manager's log.
How can I fix CVE-2020-8563 in Kubernetes?
To fix CVE-2020-8563, upgrade to Kubernetes version 1.19.3.
Is OpenShift affected by CVE-2020-8563?
Yes, OpenShift is affected by CVE-2020-8563. To fix it, upgrade to OpenShift version 4.6.0-202012051246.p0.git.94231.efc9027.el7 or later.