CVE-2020-8566: Ceph RBD adminSecrets exposed in logs when loglevel >= 4

Published Oct 9, 2020
·
Updated

A flaw was found in kubernetes. If the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims.

Other sources

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

In Kubernetes, if the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occur's in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims.

Upstream Fix:

https://github.com/kubernetes/kubernetes/pull/95245

Red Hat

Affected Software

10 affected componentsFixes available
redhat/openshift<0:4.7.0-202102060108.p0.git.97095.7271b90.el8
0:4.7.0-202102060108.p0.git.97095.7271b90.el8
redhat/kubernetes<1.19.3
1.19.3
redhat/kubernetes<1.18.10
1.18.10
redhat/kubernetes<1.17.13
1.17.13
go/github.com/kubernetes/kubernetes>=1.19.0<1.19.3
1.19.3
go/github.com/kubernetes/kubernetes>=1.18.0<1.18.10
1.18.10
go/github.com/kubernetes/kubernetes<1.17.13
1.17.13
Kubernetes kubernetes>=1.17.0<1.17.13
Kubernetes kubernetes>=1.18.0<1.18.10
Kubernetes kubernetes>=1.19.0<1.19.3

Remediation

Information

OCP Clusters not using Ceph RBD volumes are not vulnerable to this issue. For clusters using Ceph RBD volumes, this can be mitigated by ensuring the logging level is below 4 and protecting unauthorized access to cluster logs. For OCP, the logging level for core components can be configured using operators, e.g. for kube-controller-manager: https://docs.openshift.com/container-platform/latest/rest_api/operator_apis/kubecontrollermanager-operator-openshift-io-v1.html#specification In OCP, a logging level of "Debug" is equivalent to 4: https://github.com/openshift/api/blob/master/operator/v1/types.go#L96 The default logging level is "Normal", which is equivalent to 2. Clusters running with the default level are not vulnerable to this issue.

Event History

Oct 14, 2020
CVE Published
12:00 AM
Dec 7, 2020
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionSeverityWeakness
Apr 24, 2024
Advisory Published
via GitHub·08:02 PM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2020-8566?

CVE-2020-8566 is a vulnerability found in Kubernetes clusters using Ceph RBD as a storage provisioner, where Ceph RBD admin secrets can be written to logs.

2

How does CVE-2020-8566 affect Kubernetes clusters?

CVE-2020-8566 affects Kubernetes clusters with logging level of at least 4, during the provisioning of Ceph RBD persistent claims.

3

What is the severity of CVE-2020-8566?

CVE-2020-8566 has a severity rating of 5.3 (medium).

4

Which versions of Kubernetes are affected by CVE-2020-8566?

Kubernetes versions < v1.19.3, < v1.18.10, < v1.17.13 are affected by CVE-2020-8566.

5

How can I fix CVE-2020-8566 in my Kubernetes cluster?

To fix CVE-2020-8566, update Kubernetes to version 1.19.3, 1.18.10, or 1.17.13.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203