Technical information leak In k8s.io/kubernetes
Description
Kubernetes client-go library logs may disclose credentials to unauthorized users The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 0.17.0 | ||
go | 1.16.0-beta.1 | ||
 debian 14 | 1.17.4-1 | ||
debian 11 | 1.17.4-1 | ||
go | 1.16.0-beta.1 | ||
go | 0.17.0 | ||
debian 12 | 1.17.4-1 | ||
go | v1.15.4 | ||
debian 13 | 1.17.4-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10.
References
1. 2. 3. 4. 5. 6. 7.