CVE-2020-8564: Docker config secrets leaked when file is malformed and loglevel >= 4
A flaw was found in kubernetes. In Kubernetes, if the logging level is to at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This can occur with client tools like kubectl, or other components that use registry credentials in a docker config file.
Other sources
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects v1.19.3, v1.18.10, v1.17.13.
— IBM
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/atomic-openshiftto a version that resolves this vulnerability.Fixed in 0:3.11.501-1.git.0.f8c4746.el7 - Upgrade
Upgrade
redhat/openshift-clientsto a version that resolves this vulnerability.Fixed in 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.6.0-202101160934.p0.git.94242.fc5242e.el7 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.3 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.18.10 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.17.13 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.20.0-alpha.1 - Upgrade
Upgrade
go/github.com/kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.17.13 - Upgrade
Upgrade
go/github.com/kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.18.10 - Upgrade
Upgrade
go/github.com/kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.3 - Upgrade
Upgrade
kubernetesto a version that resolves this vulnerability.Fixed in v1.19.3 - Upgrade
Upgrade
kubernetesto a version that resolves this vulnerability.Fixed in v1.18.10 - Upgrade
Upgrade
kubernetesto a version that resolves this vulnerability.Fixed in v1.17.13 - Configuration
In Kubernetes clusters, set the logging level to less than 4 to prevent leaking contents of a malformed docker config file (which may include pull secrets/registry credentials).
Kubernetes logging level = < 4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8564?
CVE-2020-8564 is a vulnerability in Kubernetes that allows the contents of a malformed Docker config file to be leaked, potentially exposing pull secrets or other registry credentials.
How severe is CVE-2020-8564?
CVE-2020-8564 has a severity score of 5.3, which is considered medium.
How can I fix CVE-2020-8564?
To fix CVE-2020-8564, update your Kubernetes to version 1.20.0-alpha.1, 1.17.13, 1.18.10, 1.19.3, or later.
Where can I find more information about CVE-2020-8564?
You can find more information about CVE-2020-8564 on the CVE website, the NVD website, and in the Kubernetes GitHub repository.
What is the Common Weakness Enumeration (CWE) for CVE-2020-8564?
The CWE for CVE-2020-8564 is CWE-117 (Improper Output Neutralization for Logs) and CWE-532 (Information Exposure Through Log Files).