GitHub Advisoryadvisory · npm

GHSA-g35x-j6jj-8g7j @mittwald/kubernetes's secret contents leaked via debug logging

MEDIUM Published 2023-05-02 Modified 2023-05-02 Official page ↗
Ecosystem
npm
Packages
@mittwald/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-05-02

Affected packages

• npm @mittwald/kubernetes: < 3.5.0 → fixed in 3.5.0

Description

Impact When debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources. When running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere). Patches Upgrade to 3.5.0 or newer. Workarounds Disable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`). References • https://cwe.mitre.org/data/definitions/532.html

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References