QwikSec

Security Database

CVE

CWE

Training

CVE-2019-11250

Published: Aug 29, 2019

Modified: Sep 17, 2024

PUBLISHED

CVSS v3.0

4.7

MEDIUM

Description

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Vendor	Product	Versions
Kubernetes	Kubernetes	affected `prior to 1.16`

Weaknesses (CWE)

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

References

https://github.com/kubernetes/kubernetes/issues/81114

x_refsource_CONFIRM

https://security.netapp.com/advisory/ntap-20190919-0003/

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

vendor-advisory

x_refsource_REDHAT

[oss-security] 20201016 Kubernetes: Multiple secret leaks when verbose logging is enabled

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.