Note:
This project will be discontinued after December 13, 2021. [more]
2019-08-29
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
Products | Kubernetes, Openshift_container_platform |
Type | Information Exposure Through Log Files (CWE-532) |
First patch | - None (likely due to unavailable code) |
Links |
• https://access.redhat.com/errata/RHSA-2019:4087
• https://github.com/kubernetes/kubernetes/issues/81114 • http://www.openwall.com/lists/oss-security/2020/10/16/2 • https://access.redhat.com/errata/RHSA-2019:4052 • https://security.netapp.com/advisory/ntap-20190919-0003/ |