{"schema_version":"1.3.1","id":"GO-2021-0064","modified":"2024-07-19T16:04:58Z","published":"2021-04-14T20:04:52Z","aliases":["CVE-2020-8565","GHSA-8cfg-vx93-jvxw"],"summary":"Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go","details":"Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250.","affected":[{"package":{"name":"k8s.io/client-go","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.20.0-alpha.2"}]}],"ecosystem_specific":{"imports":[{"path":"k8s.io/client-go/transport","symbols":["basicAuthRoundTripper.RoundTrip","bearerAuthRoundTripper.RoundTrip","debuggingRoundTripper.RoundTrip","impersonatingRoundTripper.RoundTrip","requestInfo.toCurl","userAgentRoundTripper.RoundTrip"]}]}}],"references":[{"type":"FIX","url":"https://github.com/kubernetes/kubernetes/pull/95316"},{"type":"FIX","url":"https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419"},{"type":"WEB","url":"https://github.com/kubernetes/kubernetes/issues/95623"}],"credits":[{"name":"@sfowl"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0064","review_status":"REVIEWED"}}