Security Bulletin: Vulnerability in Kubernetes affects watsonx.data

Summary

If log level of kubernetes is set to at least 9, authorization and bearer tokens will be written to log files causing information to leak. In watsonx.data, one must have access to the OCP cluster, and set the log level to 9 to see this issue.

Vulnerability Details

CVEID:CVE-2020-8565
**DESCRIPTION:**Kubernetes could allow a local authenticated attacker to obtain sensitive information, caused by a flaw when kube-apiserver is using logLevel >= 9. By gaining access to the log files, an attacker could exploit this vulnerability to obtain the Kubernetes authorization tokens information, and use this information to launch further attacks against the affected system.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/189925 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2019-11250
**DESCRIPTION:**Kubernetes could allow a local authenticated attacker to obtain sensitive information, caused by storing credentials in the log by the client-go library. By sending a specially crafted command, an attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166710 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

The product needs to be installed or upgraded to the latest available level watsonx.data 2.0.1 or watsonx.data on CPD 5.0.1. Installation/upgrade instructions can be found here: <https://www.ibm.com/docs/en/watsonx/watsonxdata/2.0.x?topic=deployment-installing&gt;

Workarounds and Mitigations

None