CVE-2020-8564
Fixed in a distro release EPSS <1%CVSS 4.7
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kubernetes/kubernetes | 1.19.3 |
| Go | github.com/kubernetes/kubernetes | 1.18.10 |
| Go | github.com/kubernetes/kubernetes | 1.17.13 |
| Go | k8s.io/kubernetes | 1.20.0-alpha.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubernetes-dns-node-cache-1.17 | 0 |
| Chainguard | nodetaint | 0 |
| Chainguard | spark-operator | 1.1.27-r17 |
| Chainguard | spark-operator-oci-entrypoint | 1.1.27-r17 |
| Chainguard | sparkctl | 1.1.27-r17 |
| Debian:12 | kubernetes | 1.19.3-1 |
| Debian:13 | kubernetes | 1.19.3-1 |
| Debian:14 | kubernetes | 1.19.3-1 |
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.501-1.git.0.f8c4746.el7 |
| Red Hat:openshift:4.6 | containers-common | 1:1.1.1-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | containers-common | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | jenkins-2-plugins | 0:4.6.1601368321-1.el8 |
| Red Hat:openshift:4.6 | openshift | 0:4.6.0-202101160934.p0.git.94242.fc5242e.el8 |
| Red Hat:openshift:4.6 | openshift | 0:4.6.0-202101160934.p0.git.94242.fc5242e.el7 |
| Red Hat:openshift:4.6 | openshift-clients | 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 |
| Red Hat:openshift:4.6 | openshift-clients | 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 |
| Red Hat:openshift:4.6 | openshift-clients-redistributable | 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 |
| Red Hat:openshift:4.6 | openshift-clients-redistributable | 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 |
| Red Hat:openshift:4.6 | openshift-hyperkube | 0:4.6.0-202101160934.p0.git.94242.fc5242e.el7 |
| Red Hat:openshift:4.6 | openshift-hyperkube | 0:4.6.0-202101160934.p0.git.94242.fc5242e.el8 |
| Red Hat:openshift:4.6 | podman | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | podman-debuginfo | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | podman-debugsource | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | podman-docker | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | podman-remote | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | podman-remote-debuginfo | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | podman-tests | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | runc | 0:1.0.0-81.rhaos4.6.git5b757d4.el7 |
| Red Hat:openshift:4.6 | runc | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
| Red Hat:openshift:4.6 | runc-debuginfo | 0:1.0.0-81.rhaos4.6.git5b757d4.el7 |
| Red Hat:openshift:4.6 | runc-debuginfo | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
| Red Hat:openshift:4.6 | runc-debugsource | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
| Red Hat:openshift:4.6 | skopeo | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo | 1:1.1.1-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo-debuginfo | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo-debuginfo | 1:1.1.1-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo-debugsource | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo-debugsource | 1:1.1.1-3.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo-tests | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat:openshift:4.6 | skopeo-tests | 1:1.1.1-3.rhaos4.6.el8 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| Wolfi | nodetaint | 0 |
| Wolfi | spark-operator | 1.1.27-r17 |
| Wolfi | spark-operator-oci-entrypoint | 1.1.27-r17 |
| Wolfi | sparkctl | 1.1.27-r17 |