Bug 1860158 (CVE-2019-11252) - CVE-2019-11252 kubernetes: credential leak in kube-controller-manager via error messages in mount failure logs and events for AzureFile and CephFS volumes
Summary: CVE-2019-11252 kubernetes: credential leak in kube-controller-manager via err...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-11252
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1860204 1860205 1860206 1860207 1860208 1860210 1860290 1860475
Blocks: 1860159
TreeView+ depends on / blocked
 
Reported: 2020-07-23 19:42 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-10-28 02:58 UTC (History)
18 users (show)

Fixed In Version: kubernetes 1.18
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Kubernetes that allows the logging of credentials when mounting AzureFile and CephFS volumes. This flaw allows an attacker to access kubelet logs, read the credentials, and use them to access other services. The highest threat from this vulnerability is to confidentiality.
Clone Of:
Environment:
Last Closed: 2021-10-28 02:58:31 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-07-23 19:42:03 UTC 
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

Reference:
https://github.com/kubernetes/kubernetes/pull/88684
Comment 2 Sam Fowler 2020-07-24 01:49:43 UTC 
This patch was first included in origin in this commit:

https://github.com/openshift/origin/commit/16abec0d471f3c40e04622210edba33d43f21704
Comment 5 Sam Fowler 2020-07-24 02:10:10 UTC 
Created origin tracking bugs for this issue:

Affects: fedora-all [bug 1860210]
Comment 9 Sam Fowler 2020-08-07 04:45:34 UTC 
Statement:

OpenShift Container Platform (OCP) included the upstream patch for this flaw in the release of version 4.5. Prior versions are affected as OCP 4 supports AzureFile volumes and OCP 3 supports both AzureFile and CephFS volumes. OCP clusters not using these volume types are not vulnerable.
Note You need to log in before you can comment on or make changes to this bug.