Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
0.17.160.20.0-alpha.20.18.140.19.6· Vendor fix available
Issue
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.
Recommended action: Upgrade to 0.20.0-alpha.2 (pre-release), 0.19.6, 0.18.14 or 0.17.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
Recommended action: Upgrade to 0.17.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Recommended action: Upgrade to 1.12.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.