CVE-2020-8565: Kubernetes client-go vulnerable to Sensitive Information Leak via Log File
4.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.1843%
CWE
Published
2/6/2023
Updated
5/20/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| k8s.io/client-go | go | >= 0.19.0, < 0.19.6 | 0.19.6 |
| k8s.io/client-go | go | >= 0.20.0-alpha.0, < 0.20.0-alpha.2 | 0.20.0-alpha.2 |
| k8s.io/client-go | go | >= 0.18.0, < 0.18.14 | 0.18.14 |
| k8s.io/client-go | go | < 0.17.16 | 0.17.16 |
| k8s.io/kubernetes | go | < 1.20.0-alpha.2 | 1.20.0-alpha.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from the toCurl method in client-go's transport layer, which formats HTTP requests for logging. At logLevel >=9, this method would include raw Authorization headers in curl command output. The fix (visible in client-go commit diffs) adds a maskValue() call to redact sensitive headers. The GO-2021-0064 vulnerability report explicitly lists requestInfo.toCurl as an affected symbol, and the CVE description matches this behavior.