CVE-2020-8566: Ceph RBD adminSecrets exposed in logs when loglevel >= 4
First published: Fri Oct 09 2020(Updated: )
A flaw was found in kubernetes. If the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims.
Credit: jordan@liggitt.net jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openshift | <0:4.7.0-202102060108.p0.git.97095.7271b90.el8 | 0:4.7.0-202102060108.p0.git.97095.7271b90.el8 |
| Kubernetes Kubernetes | >=1.17.0<1.17.13 | |
| Kubernetes Kubernetes | >=1.18.0<1.18.10 | |
| Kubernetes Kubernetes | >=1.19.0<1.19.3 | |
| redhat/kubernetes | <1.19.3 | 1.19.3 |
| redhat/kubernetes | <1.18.10 | 1.18.10 |
| redhat/kubernetes | <1.17.13 | 1.17.13 |
| go/github.com/kubernetes/kubernetes | >=1.19.0<1.19.3 | 1.19.3 |
| go/github.com/kubernetes/kubernetes | >=1.18.0<1.18.10 | 1.18.10 |
| go/github.com/kubernetes/kubernetes | <1.17.13 | 1.17.13 |
Remedy
OCP Clusters not using Ceph RBD volumes are not vulnerable to this issue. For clusters using Ceph RBD volumes, this can be mitigated by ensuring the logging level is below 4 and protecting unauthorized access to cluster logs. For OCP, the logging level for core components can be configured using operators, e.g. for kube-controller-manager: https://docs.openshift.com/container-platform/latest/rest_api/operator_apis/kubecontrollermanager-operator-openshift-io-v1.html#specification In OCP, a logging level of "Debug" is equivalent to 4: https://github.com/openshift/api/blob/master/operator/v1/types.go#L96 The default logging level is "Normal", which is equivalent to 2. Clusters running with the default level are not vulnerable to this issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-8566 https://nvd.nist.gov/vuln/detail/CVE-2020-8566 https://github.com/kubernetes/kubernetes/issues/95624 https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
- https://bugzilla.redhat.com/show_bug.cgi?id=1886640
- https://access.redhat.com/errata/RHSA-2021:0037
- https://access.redhat.com/errata/RHSA-2020:5634
- https://access.redhat.com/security/cve/cve-2020-8566
- https://github.com/kubernetes/kubernetes/issues/95624
- https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
- https://security.netapp.com/advisory/ntap-20210122-0006/
- https://github.com/kubernetes/kubernetes/pull/95245
- https://docs.openshift.com/container-platform/latest/rest_api/operator_apis/kubecontrollermanager-operator-openshift-io-v1.html#specification
- https://github.com/openshift/api/blob/master/operator/v1/types.go#L96
- https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
- https://nvd.nist.gov/vuln/detail/CVE-2020-8566
- https://github.com/kubernetes/kubernetes/pull/95245/commits/e91ec4fad3366d2dee020919f7c2a0d7b52fd3ea
- https://security.netapp.com/advisory/ntap-20210122-0006
- https://github.com/advisories/GHSA-5x96-j797-5qqw (Advisory)
Frequently Asked Questions
What is CVE-2020-8566?
CVE-2020-8566 is a vulnerability found in Kubernetes clusters using Ceph RBD as a storage provisioner, where Ceph RBD admin secrets can be written to logs.
How does CVE-2020-8566 affect Kubernetes clusters?
CVE-2020-8566 affects Kubernetes clusters with logging level of at least 4, during the provisioning of Ceph RBD persistent claims.
What is the severity of CVE-2020-8566?
CVE-2020-8566 has a severity rating of 5.3 (medium).
Which versions of Kubernetes are affected by CVE-2020-8566?
Kubernetes versions < v1.19.3, < v1.18.10, < v1.17.13 are affected by CVE-2020-8566.
How can I fix CVE-2020-8566 in my Kubernetes cluster?
To fix CVE-2020-8566, update Kubernetes to version 1.19.3, 1.18.10, or 1.17.13.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup
- agent/remedy
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-8566
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5x96-j797-5qqw
- agent/references
- agent/author
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.17.0
- version/kubernetes kubernetes/1.18.0
- version/kubernetes kubernetes/1.19.0
- package-manager/go