PT-2020-20210 · Linux Foundation+2 · Kubernetes+1

Nikolaos Moraitis · Published 2020-10-15 · Updated 2023-02-06 · CVE-2020-8564

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.19.3 Kubernetes versions prior to 1.18.10 Kubernetes versions prior to 1.17.13

Description The issue arises when a Kubernetes cluster uses a logging level of at least 4 and encounters a malformed docker config file. This can lead to the leakage of the docker config file's contents, potentially including pull secrets or other registry credentials. The leakage occurs due to the improper handling of the malformed file.

Recommendations For versions prior to 1.19.3, update to version 1.19.3 or later to resolve the issue. For versions prior to 1.18.10, update to version 1.18.10 or later to resolve the issue. For versions prior to 1.17.13, update to version 1.17.13 or later to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

ALT-PU-2021-1227

ALT-PU-2021-1495

ALT-PU-2022-1245

CVE-2020-8564

GHSA-8MJG-8C8G-6H85

GO-2021-0066

RHSA-2020:4297

RHSA-2021:0172

RHSA-2021:3193

Affected Products

Alt Linux

Kubernetes

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8564 · Vendor Advisory
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ · Patch
• https://osv.dev/vulnerability/GO-2021-0066 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8564 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8564 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8564 · Security Note
• https://osv.dev/vulnerability/GHSA-8mjg-8c8g-6h85 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8564 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8564 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8564 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/issues/95622 · Note
• https://github.com/kubernetes/kubernetes/pull/94712 · Note
• https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634 · Note
• https://pkg.go.dev/vuln/GO-2021-0066 · Note