Bug 1860158 (CVE-2019-11252)

Summary:	CVE-2019-11252 kubernetes: credential leak in kube-controller-manager via error messages in mount failure logs and events for AzureFile and CephFS volumes
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	admiller, aos-bugs, bmontgom, cscribne, eparis, hchiramm, hvyas, jburrell, jcajka, jmulligan, jokerman, madam, mfojtik, nstielau, rhs-bugs, sfowler, sponnaga, sttts
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kubernetes 1.18	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Kubernetes that allows the logging of credentials when mounting AzureFile and CephFS volumes. This flaw allows an attacker to access kubelet logs, read the credentials, and use them to access other services. The highest threat from this vulnerability is to confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 02:58:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1860204, 1860205, 1860206, 1860207, 1860208, 1860210, 1860290, 1860475
Bug Blocks:	1860159

Description Guilherme de Almeida Suckevicz 2020-07-23 19:42:03 UTC

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

Reference:
https://github.com/kubernetes/kubernetes/pull/88684

Comment 2 Sam Fowler 2020-07-24 01:49:43 UTC

This patch was first included in origin in this commit:

https://github.com/openshift/origin/commit/16abec0d471f3c40e04622210edba33d43f21704

Comment 5 Sam Fowler 2020-07-24 02:10:10 UTC

Created origin tracking bugs for this issue:

Affects: fedora-all [bug 1860210]

Comment 9 Sam Fowler 2020-08-07 04:45:34 UTC

Statement:

OpenShift Container Platform (OCP) included the upstream patch for this flaw in the release of version 4.5. Prior versions are affected as OCP 4 supports AzureFile volumes and OCP 3 supports both AzureFile and CephFS volumes. OCP clusters not using these volume types are not vulnerable.