In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
BAC4DF80-12A5-482D-88C8-1939A015FBE4
1.17.13
1.17.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
57F3AFC9-8D1D-4870-B40E-5A2CFEB2388E
1.18.10
1.18.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
13CE6526-CD5D-4B0D-AE8C-20E113F2D412
1.19.3
1.19.0
OR
CVSS Rating: 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (Medium)

In Kubernetes, if the logging level is to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like `kubectl`.

### Am I vulnerable?
If kube-apiserver is using a log level of at least 9.

#### Affected Versions
kubernetes v1.19.0 - v1.19.5
kubernetes v1.18.0 - v1.18.13
kubernetes v1.17.0 - v1.17.15

### How do I mitigate this vulnerability?
Do not enable verbose logging in production, limit access to logs.

#### Fixed Versions
kubernetes v1.20.0
kubernetes v1.19.6 
kubernetes v1.18.14 
kubernetes v1.17.16

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

### Acknowledgements
This vulnerability was reported by: Patrick Rhomberg (purelyapplied)

/area security
/kind bug
/committee product-security

CVE-2020-8565: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8565: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
Issue date:

--- start body ---
CVSS Rating: 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (Medium)

In Kubernetes, if the logging level is to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like `kubectl`.

### Am I vulnerable?
If kube-apiserver is using a log level of at least 9.

#### Affected Versions
kubernetes v1.19.0 - v1.19.5
kubernetes v1.18.0 - v1.18.13
kubernetes v1.17.0 - v1.17.15

### How do I mitigate this vulnerability?
Do not enable verbose logging in production, limit access to logs.

#### Fixed Versions
kubernetes v1.20.0
kubernetes v1.19.6 
kubernetes v1.18.14 
kubernetes v1.17.16

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

### Acknowledgements
This vulnerability was reported by: Patrick Rhomberg (purelyapplied)

/area security
/kind bug
/committee product-security

--- end body ---

comments :
--- start comments ---

--- end comments ---