In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
515661A5-8AFF-45B7-932C-3B5CD32945F0
1.19.3
OR
CVSS Rating: 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N (Medium)

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.

### Am I vulnerable?
If you are using VSphere as a cloud provider, have verbose logging enabled, and an attacker can access cluster logs, then you may be vulnerable to this.

#### Affected Versions
kube-controller-manager v1.19.0 - v1.19.2

#### How do I mitigate this vulnerability?
Do not enable verbose logging in production, limit access to cluster logs.

#### Fixed Versions
v1.19.3

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

### Acknowledgements
This vulnerability was reported by: Kaizhe Huang (derek0405)

/area security
/kind bug
/committee product-security

CVE-2020-8563: Secret leaks in kube-controller-manager when using vSphere provider
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8563: Secret leaks in kube-controller-manager when using vSphere provider
Issue date:

--- start body ---
CVSS Rating: 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N (Medium)

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log.

### Am I vulnerable?
If you are using VSphere as a cloud provider, have verbose logging enabled, and an attacker can access cluster logs, then you may be vulnerable to this.

#### Affected Versions
kube-controller-manager v1.19.0 - v1.19.2

#### How do I mitigate this vulnerability?
Do not enable verbose logging in production, limit access to cluster logs.

#### Fixed Versions
v1.19.3

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

### Acknowledgements
This vulnerability was reported by: Kaizhe Huang (derek0405)

/area security
/kind bug
/committee product-security

--- end body ---

comments :
--- start comments ---

--- end comments ---