GitHub Advisoryadvisory · Go

GHSA-jmrx-5g74-6v2f Kubernetes client-go library logs may disclose credentials to unauthorized users

MEDIUM Published 2022-05-24 Modified 2025-02-28 Official page ↗
Aliases
CVE-2019-11250
Ecosystem
Go
Packages
k8s.io/client-go, k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-02-08

Affected packages

• Go k8s.io/client-go: < 0.17.0 → fixed in 0.17.0 • Go k8s.io/kubernetes: < 1.16.0-beta.1 → fixed in 1.16.0-beta.1

Description

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Related

Alias · CVE (1)

  • CVE-2019-11250 The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References