CVE-2020-8564:Kubernetes logs sensitive information from docker config files when verbose logging is enabled.

splash
Back

Description Preview

In Kubernetes clusters using a logging level of at least 4 (verbose logging), processing a malformed docker config file results in the contents of the docker config file being leaked in logs. These leaked contents can include pull secrets or other registry credentials, potentially exposing sensitive authentication information. This vulnerability affects Kubernetes versions prior to v1.19.3, v1.18.10, and v1.17.13.

Overview

CVE-2020-8564 is a security vulnerability related to information disclosure in Kubernetes. When verbose logging is enabled (level 4 or higher), the system will log the contents of docker configuration files during processing, even when these files are malformed. This behavior can expose sensitive information such as registry credentials, authentication tokens, and pull secrets that are stored in these configuration files. The vulnerability is classified as CWE-532 (Information Exposure Through Log Files) and affects multiple versions of Kubernetes. This issue is particularly concerning in multi-tenant environments where logs might be accessible to various users or administrators.

Remediation

To address this vulnerability, users should upgrade their Kubernetes installations to the following versions or later:

  • v1.19.3 or later for the 1.19.x branch
  • v1.18.10 or later for the 1.18.x branch
  • v1.17.13 or later for the 1.17.x branch

If immediate upgrading is not possible, a temporary mitigation would be to reduce the logging verbosity level to below 4, which will prevent the sensitive information from being logged. However, this may impact troubleshooting capabilities and should be considered a short-term solution only.

Additionally, organizations should review their existing logs for potential exposure of sensitive information and implement proper log management practices to restrict access to logs containing sensitive data.

References

  1. Kubernetes GitHub Issue: https://github.com/kubernetes/kubernetes/issues/95622
  2. Kubernetes Security Discussion: https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
  3. NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20210122-0006/

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  3. Transportation & Warehousing
    Transportation & Warehousing
  4. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  5. Finance and Insurance
    Finance and Insurance
  6. Health Care & Social Assistance
    Health Care & Social Assistance
  7. Management of Companies & Enterprises
    Management of Companies & Enterprises
  8. Other Services (except Public Administration)
    Other Services (except Public Administration)
  9. Retail Trade
    Retail Trade
  10. Accommodation & Food Services
    Accommodation & Food Services
  11. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  12. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  13. Construction
    Construction
  14. Educational Services
    Educational Services
  15. Information
    Information
  16. Mining
    Mining
  17. Public Administration
    Public Administration
  18. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background
Armis Vulnerability Intelligence Database