Unprotected storage of credentials in Kubernetes - CVE-2019-11250

Vulnerability identifier: #VU23636

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11250

CWE-ID: CWE-256

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.

Kubernetes
IBM Observability with Instana
IBM Robotic Process Automation
Netcool Operations Insight
IBM Cloud Pak for Data Scheduling
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Maximo Application Suite
DB2 Data Management Console
ObjectScale
IBM Cloud Pak for Watson AIOps
DataStage on Cloud Pak for Data
Red Hat OpenShift Container Platform
Fedora
kubernetes
mcg (Red Hat package)
watsonx.data
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM DB2

Install updates from vendor's website.

Kubernetes - update to 1.16.0
DB2 Data Management Console - update to 3.1.13
Red Hat OpenShift Container Platform - update to 4.1.27
IBM Robotic Process Automation - update to 21.0.2.5
ObjectScale - update to 1.4.0
Netcool Operations Insight - update to 1.6.10
kubernetes - update to 1.15.2-1.fc30
watsonx.data - update to 2.0.1
IBM Cloud Pak for Data Scheduling - update to 4.8.0
IBM Cloud Pak for Watson AIOps - update to 4.8.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.9.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0
IBM DB2 - update to 5.0
DataStage on Cloud Pak for Data - update to 5.0.0
mcg (Red Hat package) - update to 5.9.0-28.61dcf87.5.9.el8
IBM Maximo Application Suite - addressed in versions 8.10.16, 8.11.14, 9.0.1

• https://github.com/kubernetes/kubernetes/issues/81114
• https://security.netapp.com/advisory/ntap-20190919-0003/
• https://github.com/kubernetes/kubernetes/pull/81330/commits/010d8382642119c73cb2405286b347c08d704287#diff-f5423923c5f61f08517f3eb0014e48ee

• Insecure storage of credentials in Kubernetes
• Red Hat update for OpenShift Container Platform 3.11 atomic-openshift
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• IBM Cloud Pak for Data Scheduling update for kubectl
• Multiple vulnerabilities in Netcool Operations Insight
• Unprotected storage of credentials in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.9
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Fedora 30 update for kubernetes
• Multiple vulnerabilities in IBM DB2 Data Management Console