Kubernetes up to 1.17.12/1.18.9/1.19.2 Config File log file

Summaryinfo

A vulnerability described as problematic has been identified in Kubernetes up to 1.17.12/1.18.9/1.19.2. This vulnerability affects unknown code of the component Config File Handler. Such manipulation leads to log file. This vulnerability is traded as CVE-2020-8564. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Kubernetes up to 1.17.12/1.18.9/1.19.2 (Virtualization Software). Affected by this issue is an unknown code block of the component Config File Handler. The manipulation with an unknown input leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality.

The weakness was shared 12/08/2020. The advisory is available at github.com. This vulnerability is handled as CVE-2020-8564. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 1.17.13, 1.18.10 or 1.19.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Name

• Kubernetes

Version

• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.17.7
• 1.17.8
• 1.17.9
• 1.17.10
• 1.17.11
• 1.17.12
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.18.4
• 1.18.5
• 1.18.6
• 1.18.7
• 1.18.8
• 1.18.9
• 1.19.0
• 1.19.1
• 1.19.2

License

• open-source

Website

• Product: https://github.com/kubernetes/kubernetes/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion