CVE-2019-10223 — Sensitive Information Exposure in Kubernetes Kube-state-metrics

CWE-200 — Sensitive Information Exposure8 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
1.1%
top 22.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Github.com Kubernetes Kube-state-metricsK8s.io Kube-state-metricsRED HAT Kube-state-metrics+2 more
Timeline
PublishedNov 5
Latest updateMay 24

Description

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been revert…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Gok8s.io/kube-state-metrics1.7.0 — 1.7.2
▶CVEListV5red_hat/kube-state-metricskube-state-metrics versions v1.7.0 and v1.7.1
▶NVDkubernetes/kube-state-metrics1.7.0, 1.7.1+1

Also affects: Openshift Container Platform 3.11, 4.1, 4.2

🔴Vulnerability Details

5
OSV
kube-state-metrics may expose secret content in metrics↗2022-05-24
▶
GHSA
kube-state-metrics may expose secret content in metrics↗2022-05-24
▶
OSV
Exposure of sensitive information in k8s.io/kube-state-metrics↗2021-05-18
▶
OSV
Duplicate Advisory: k8s.io/kube-state-metrics Exposure of Sensitive Information↗2021-05-18
▶
CVEList
CVE-2019-10223: A security issue was discovered in the kube-state-metrics versions v1↗2019-11-05
▶

📋Vendor Advisories

1
Red Hat
kube-state-metrics: annotations exposed as metrics in combination with `kubectl` can allow for exposure of secrets↗2019-08-09
▶

💬Community

1
Bugzilla
CVE-2019-10223 kube-state-metrics: annotations exposed as metrics in combination with `kubectl` can allow for exposure of secrets↗2019-08-13
▶
CVE-2019-10223 — Sensitive Information Exposure | cvebase