CVE-2020-8566:
Sensitive Information leak via Log File in Kubernetes
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.43395%
CWE
Published
4/24/2024
Updated
4/24/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kubernetes/kubernetes | go | < 1.17.13 | 1.17.13 |
| github.com/kubernetes/kubernetes | go | >= 1.18.0, < 1.18.10 | 1.18.10 |
| github.com/kubernetes/kubernetes | go | >= 1.19.0, < 1.19.3 | 1.19.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from multiple functions in rbd_util.go that logged sensitive adminSecret values using klog.V(4).Infof. The commit diff shows these functions previously included the secret in log messages, which was later masked. All identified functions handle Ceph RBD operations and contained explicit logging of credentials at verbosity level 4, matching the vulnerability description.