Bug 1759118 - kube-state-metrics: new feature exposing annotations as metrics can lead to information disclosure
Summary: kube-state-metrics: new feature exposing annotations as metrics can lead to i...
Keywords:
Status: CLOSED DUPLICATE of bug 1740431
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1759119
TreeView+ depends on / blocked
 
Reported: 2019-10-07 12:50 UTC by Marian Rehak
Modified: 2020-03-18 04:53 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-12-01 23:41:32 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2019-10-07 12:50:57 UTC 
A combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.

Upstream advisory:

https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
Comment 1 Sam Fowler 2019-12-01 23:41:32 UTC 

*** This bug has been marked as a duplicate of bug 1740431 ***
Note You need to log in before you can comment on or make changes to this bug.