What is CVE-2020-8565?

CVE-2020-8565 is a medium-severity vulnerability in Kubernetes, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.7/10. Published 2020-12-07.

How severe is CVE-2020-8565?

Medium severity. CVSS v3 base score is 4.7 out of 10.

Is CVE-2020-8565 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Kubernetes

CVE-2020-8565

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

EPSS: 0.005 (40.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Kubernetes — versions <= 1.19.3, <= 1.18.10, <= 1.17.13

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

Public proof-of-concept exploits

References

jordan@liggitt.net (mailing-list, x_refsource_MLIST, Patch, Mailing List, Third Party Advisory)
jordan@liggitt.net (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2020-8565?: CVE-2020-8565 is a medium-severity vulnerability in Kubernetes, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.7/10. Published 2020-12-07.
How severe is CVE-2020-8565?: Medium severity. CVSS v3 base score is 4.7 out of 10.
Is CVE-2020-8565 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.