CVE-2020-8566: Ceph RBD adminSecrets exposed in logs when loglevel >= 4
A flaw was found in kubernetes. If the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims.
Other sources
In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.
In Kubernetes, if the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occur's in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims.
Upstream Fix:
https://github.com/kubernetes/kubernetes/pull/95245
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8566?
CVE-2020-8566 is a vulnerability found in Kubernetes clusters using Ceph RBD as a storage provisioner, where Ceph RBD admin secrets can be written to logs.
How does CVE-2020-8566 affect Kubernetes clusters?
CVE-2020-8566 affects Kubernetes clusters with logging level of at least 4, during the provisioning of Ceph RBD persistent claims.
What is the severity of CVE-2020-8566?
CVE-2020-8566 has a severity rating of 5.3 (medium).
Which versions of Kubernetes are affected by CVE-2020-8566?
Kubernetes versions < v1.19.3, < v1.18.10, < v1.17.13 are affected by CVE-2020-8566.
How can I fix CVE-2020-8566 in my Kubernetes cluster?
To fix CVE-2020-8566, update Kubernetes to version 1.19.3, 1.18.10, or 1.17.13.