CVE-2020-8565
Fixed in a distro release EPSS <1%CVSS 4.7
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/client-go | 0.19.6 |
| Go | k8s.io/client-go | 0.20.0-alpha.2 |
| Go | k8s.io/client-go | 0.18.14 |
| Go | k8s.io/client-go | 0.17.16 |
| Go | k8s.io/kubernetes | 1.20.0-alpha.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gostatsd | 28.3.0-r33 |
| Chainguard | kubeflow-access-management | no fix |
| Chainguard | kubeflow-access-management-fips | no fix |
| Chainguard | kubeflow-pipelines | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-apiserver | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-cache_server | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-frontend | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.2.0-r3 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r3 |
| Chainguard | kubernetes-secret-generator | no fix |
| Chainguard | newrelic-nri-statsd | 2.14.0-r2 |
| Chainguard | nodetaint | 0 |
| Chainguard | spark-operator | 2.1.0-r8 |
| Chainguard | spark-operator-oci-entrypoint | 2.1.0-r8 |
| Chainguard | sparkctl | 2.1.0-r8 |
| Debian 12 | kubernetes | 1.20.0-1 |
| Debian 13 | kubernetes | 1.20.0-1 |
| Debian 14 | kubernetes | 1.20.0-1 |
| Red Hat openshift data foundation 4.9 | mcg | 0:5.9.0-28.61dcf87.5.9.el8 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | kubernetes | 1.17.13-4.21.2 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | gostatsd | 28.3.0-r33 |
| Wolfi | kubeflow-access-management | no fix |
| Wolfi | kubeflow-pipelines | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-apiserver | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-cache_server | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-frontend | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.2.0-r3 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r3 |
| Wolfi | newrelic-nri-statsd | 2.14.0-r2 |
| Wolfi | nodetaint | 0 |
| Wolfi | spark-operator | 2.1.0-r8 |
| Wolfi | spark-operator-oci-entrypoint | 2.1.0-r8 |
| Wolfi | sparkctl | 2.1.0-r8 |