CVE-2020-8563: Secret leaks in logs for vSphere Provider kube-controller-manager
First published: Fri Oct 09 2020(Updated: )
A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.
Credit: jordan@liggitt.net jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openshift | <0:4.6.0-202012051246.p0.git.94231.efc9027.el8 | 0:4.6.0-202012051246.p0.git.94231.efc9027.el8 |
| Kubernetes Kubernetes | <1.19.3 | |
| redhat/kubernetes | <1.19.3 | 1.19.3 |
| go/github.com/kubernetes/kubernetes | <1.19.3 | 1.19.3 |
Remedy
Ensure that the logging level is below 4. Additionally, protect unauthorized access to cluster logs. For OCP, the logging level for core components can be configured using operators, e.g. for kube-controller-manager: https://docs.openshift.com/container-platform/latest/rest_api/operator_apis/kubecontrollermanager-operator-openshift-io-v1.html#specification In OCP, a logging level of "Debug" is equivalent to 4: https://github.com/openshift/api/blob/master/operator/v1/types.go#L96 The default logging level is "Normal", which is equivalent to 2. Clusters running with the default level are not vulnerable to this issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-8563 https://nvd.nist.gov/vuln/detail/CVE-2020-8563 https://github.com/kubernetes/kubernetes/issues/95621 https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
- https://bugzilla.redhat.com/show_bug.cgi?id=1886635
- https://access.redhat.com/errata/RHSA-2020:5260
- https://access.redhat.com/errata/RHSA-2020:5633
- https://access.redhat.com/security/cve/cve-2020-8563
- https://github.com/kubernetes/kubernetes/issues/95621
- https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
- https://security.netapp.com/advisory/ntap-20210122-0006/
- https://github.com/kubernetes/kubernetes/pull/95236
- https://github.com/kubernetes/kubernetes/commit/9e0555446238b2dfe45805babc2b6982565c293d
- https://docs.openshift.com/container-platform/latest/rest_api/operator_apis/kubecontrollermanager-operator-openshift-io-v1.html#specification
- https://github.com/openshift/api/blob/master/operator/v1/types.go#L96
- https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
- https://nvd.nist.gov/vuln/detail/CVE-2020-8563
- https://github.com/kubernetes/kubernetes/pull/95236/commits/247f6dd09299bc7893c1e0affea11c0255025b96
- https://security.netapp.com/advisory/ntap-20210122-0006
- https://github.com/advisories/GHSA-5xfg-wv98-264m (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-8563?
The severity of CVE-2020-8563 is medium with a CVSS score of 6.3.
How does CVE-2020-8563 affect Kubernetes clusters?
CVE-2020-8563 affects Kubernetes clusters running on VSphere, using VSphere as a cloud provider with a logging level set to 4 or above.
What information is leaked in the cloud controller manager's log in CVE-2020-8563?
In CVE-2020-8563, VSphere cloud credentials are leaked in the cloud controller manager's log.
How can I fix CVE-2020-8563 in Kubernetes?
To fix CVE-2020-8563, upgrade to Kubernetes version 1.19.3.
Is OpenShift affected by CVE-2020-8563?
Yes, OpenShift is affected by CVE-2020-8563. To fix it, upgrade to OpenShift version 4.6.0-202012051246.p0.git.94231.efc9027.el7 or later.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-8563
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5xfg-wv98-264m
- agent/references
- agent/author
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/tags
- agent/event
- package-manager/redhat
- vendor/kubernetes
- canonical/kubernetes kubernetes
- package-manager/go