CVE-2020-8565: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
A flaw was found in kubernetes. In Kubernetes, if the logging level is to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. Previously, CVE-2019-11250 was assigned for the same issue for logging levels of at least 4.
Other sources
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.
— GitHub
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects = v1.19.3, = v1.18.10, = v1.17.13, v1.20.0-alpha2.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mcgto a version that resolves this vulnerability.Fixed in 0:5.9.0-28.61dcf87.5.9.el8 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.20.0-alpha.2 - Upgrade
Upgrade
go/k8s.io/client-goto a version that resolves this vulnerability.Fixed in 0.17.16 - Upgrade
Upgrade
go/k8s.io/client-goto a version that resolves this vulnerability.Fixed in 0.18.14 - Upgrade
Upgrade
go/k8s.io/client-goto a version that resolves this vulnerability.Fixed in 0.20.0-alpha.2 - Upgrade
Upgrade
go/k8s.io/client-goto a version that resolves this vulnerability.Fixed in 0.19.6 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.20.0 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.6 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.18.14 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.17.16 - Configuration
Set Kubernetes logging level to less than 9 to prevent authorization and bearer tokens from being written to log files (affected when logLevel >= 9).
Kubernetes logLevel = < 9
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8565?
CVE-2020-8565 is a vulnerability in Kubernetes where authorization and bearer tokens are written to log files when the logging level is set to at least 9.
What is the severity of CVE-2020-8565?
CVE-2020-8565 has a severity value of 5.3, which is classified as medium severity.
How can the CVE-2020-8565 vulnerability be fixed?
To fix the CVE-2020-8565 vulnerability, update Kubernetes to version 1.20.0 or above.
Is there a workaround for the CVE-2020-8565 vulnerability?
There is no known workaround for the CVE-2020-8565 vulnerability. Updating Kubernetes to the fixed version is recommended.
Where can I find more information about CVE-2020-8565?
You can find more information about CVE-2020-8565 on the Red Hat Security Advisory page and the GitHub pull request page.