CVE-2020-8563: Secret leaks in logs for vSphere Provider kube-controller-manager

Q: What is the severity of CVE-2020-8563?

The severity of CVE-2020-8563 is medium with a CVSS score of 6.3.

Q: How does CVE-2020-8563 affect Kubernetes clusters?

CVE-2020-8563 affects Kubernetes clusters running on VSphere, using VSphere as a cloud provider with a logging level set to 4 or above.

Q: What information is leaked in the cloud controller manager's log in CVE-2020-8563?

In CVE-2020-8563, VSphere cloud credentials are leaked in the cloud controller manager's log.

Q: How can I fix CVE-2020-8563 in Kubernetes?

To fix CVE-2020-8563, upgrade to Kubernetes version 1.19.3.

Q: Is OpenShift affected by CVE-2020-8563?

Yes, OpenShift is affected by CVE-2020-8563. To fix it, upgrade to OpenShift version 4.6.0-202012051246.p0.git.94231.efc9027.el7 or later.

Published Oct 9, 2020

Updated

A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.

Other sources

In Kubernetes clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.

Upstream Fix:

https://github.com/kubernetes/kubernetes/pull/95236

— Red Hat

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Affected Software

4 affected componentsFixes available

redhat/openshift<0:4.6.0-202012051246.p0.git.94231.efc9027.el8

0:4.6.0-202012051246.p0.git.94231.efc9027.el8

redhat/kubernetes<1.19.3

1.19.3

go/github.com/kubernetes/kubernetes<1.19.3

1.19.3

Kubernetes kubernetes<1.19.3

Remediation

Patch Available

https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ

Information

Ensure that the logging level is below 4. Additionally, protect unauthorized access to cluster logs. For OCP, the logging level for core components can be configured using operators, e.g. for kube-controller-manager: https://docs.openshift.com/container-platform/latest/rest_api/operator_apis/kubecontrollermanager-operator-openshift-io-v1.html#specification In OCP, a logging level of "Debug" is equivalent to 4: https://github.com/openshift/api/blob/master/operator/v1/types.go#L96 The default logging level is "Normal", which is equivalent to 2. Clusters running with the default level are not vulnerable to this issue.

Event History

Oct 14, 2020

CVE Published

12:00 AM

Dec 7, 2020

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionSeverityWeakness

Apr 24, 2024

Advisory Published

via GitHub·08:02 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2020-8563?