Log in Start free

Vulnerability · Published Dec 7, 2020 · Assigned by kubernetes

CVE-2020-8566Ceph RBD adminSecrets exposed in logs when loglevel >= 4

Medium 4.7

In plain English

A medium-severity sensitive data in logs in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.5%top 55.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kubernetes1.19.3-1DEBIAN-CVE-2020-8566
Debian:13kubernetes1.19.3-1DEBIAN-CVE-2020-8566
Debian:14kubernetes1.19.3-1DEBIAN-CVE-2020-8566
Gogithub.com/kubernetes/kubernetes1.17.13GHSA-5x96-j797-5qqw
Gogithub.com/kubernetes/kubernetes1.18.10GHSA-5x96-j797-5qqw
Gogithub.com/kubernetes/kubernetes1.19.3GHSA-5x96-j797-5qqw
Gok8s.io/kubernetes1.17.13, 1.18.10, 1.19.3GO-2024-2754
Ubuntu:22.04:LTSkubernetesno fix listedUBUNTU-CVE-2020-8566
Ubuntu:24.04:LTSkubernetesno fix listedUBUNTU-CVE-2020-8566

Affected products (as reported)

VendorProductVersions
Kubernetes Kubernetes < 1.19.3< 1.18.10< 1.17.13

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References