Description The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Exploitability: 2.8 | Impact: 3.6 Attack Vector: Network
Complexity: Low
Privileges: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None
Affected Packages5 packages Also affects: Openshift Container Platform 3.11, 4.1
🔴 Vulnerability Details6 OSV Kubernetes client-go library logs may disclose credentials to unauthorized users ↗ 2022-05-24 ▶ GHSA Kubernetes client-go library logs may disclose credentials to unauthorized users ↗ 2022-05-24 ▶ OSV Unauthorized credential disclosure in k8s.io/kubernetes and k8s.io/client-go ↗ 2021-04-14 ▶ OSV Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go ↗ 2021-04-14 ▶ CVEList Kubernetes client-go logs authorization headers at debug verbosity levels ↗ 2019-08-29 ▶ Show 1 more
📋 Vendor Advisories4 Microsoft Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 ↗ 2020-12-08 ▶ Red Hat kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 ↗ 2020-10-14 ▶ Red Hat kubernetes: Bearer tokens written to logs at high verbosity levels (>= 7) ↗ 2019-08-13 ▶ Debian CVE-2019-11250: kubernetes - The Kubernetes client-go library logs request headers at verbosity levels of 7 o... ↗ 2019 ▶
💬 Community4 HackerOne CVE-2019-11250 remains in effect. ↗ 2020-11-29 ▶ Bugzilla CVE-2020-8565 kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 ↗ 2020-10-09 ▶ Bugzilla CVE-2019-11250 kubernetes: Bearer tokens written to logs at high verbosity levels (>= 7) [fedora-all] ↗ 2019-08-13 ▶ Bugzilla CVE-2019-11250 kubernetes: Bearer tokens written to logs at high verbosity levels (>= 7) ↗ 2019-08-13 ▶