Inclusion of Sensitive Information in Log Files in Kubernetes - CVE-2020-8563

Vulnerability identifier: #VU48976

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8563

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. A local user can read the log files and gain access to sensitive data.

Kubernetes
cri-o (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
openshift-kuryr (Red Hat package)
python-pyroute2 (Red Hat package)
python-eventlet (Red Hat package)
ironic-images (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Kubernetes - update to 1.19.3
cri-o (Red Hat package) - update to 1.19.0-26.rhaos4.6.git8a05a29.el8
openshift-ansible (Red Hat package) - update to 4.6.0-202011260456.p0.git.0.e7caea2.el7
openshift (Red Hat package) - addressed in versions 4.6.0-202012051246.p0.git.94231.efc9027.el7, 4.6.0-202012051246.p0.git.94231.efc9027.el8
openshift-clients (Red Hat package) - addressed in versions 4.6.0-202011260456.p0.git.3798.fcf58ff.el7, 4.6.0-202011260456.p0.git.3798.fcf58ff.el8
openshift-kuryr (Red Hat package) - update to 4.6.0-202012042155.p0.git.2216.8a6f6a5.el8
Red Hat OpenShift Container Platform - update to 4.6.8
python-pyroute2 (Red Hat package) - update to 0.5.13-1.el8ost
python-eventlet (Red Hat package) - update to 0.25.2-3.el8ost
ironic-images (Red Hat package) - update to 15.1-20201201.1.el8

• https://github.com/kubernetes/kubernetes/issues/95621
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ

• Information disclosure in Kubernetes
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in OpenShift Container Platform