CVE-2020-8563

MEDIUM severity · CVSS 4.7 · CWE-532

4.7CVSS MEDIUM

Summary

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Impact & exploitability

Attack vectorLocal

Attack complexityHigh

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

Kubernetes

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ ↗

Additional information

NVD record
https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJPatch
https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJPatch
https://github.com/kubernetes/kubernetes/issues/95621Advisory
https://security.netapp.com/advisory/ntap-20210122-0006/Advisory
https://github.com/kubernetes/kubernetes/issues/95621Advisory
https://security.netapp.com/advisory/ntap-20210122-0006/Advisory