CVE-2020-8565

CVE-2020-8565 affects Kubernetes components (notably API server and kubectl output) where, at logging level 9 or higher, authorization and bearer tokens are written to log files. Public-visibility details in connected docs confirm impact on multiple Kubernetes versions, including <= v1.19.3, &...

CVE-2020-8565 Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects = v1.19.3, = v1.18.10, = v1.17.13, v1.20.0-alpha2...

Information Disclosure

github.com/kubernetes/kubernetes is vulnerable to information disclosure. When the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, the Ceph RBD admin secrets are written to logs and allow for a user to retrieve the confidential information...

Information Disclosure

github.com/kubernetes/kubernetes is vulnerable to information disclosure. When using using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will are leaked in the cloud controller manager's log...

CVE-2020-8563

A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. Mitigation Ensure that the logging level is below 4. Additionally, protect...

CVE-2020-8563

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects v1.19.3...

PT-2020-20211

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to v1.20.0-alpha2 Kubernetes versions 1.19.3 and earlier Kubernetes versions 1.18.10 and earlier Kubernetes versions 1.17.13 and earlier Description In Kubernetes, if the logging level is set to at least 9,...

PT-2020-20212

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.19.3 Kubernetes versions prior to 1.18.10 Kubernetes versions prior to 1.17.13 Description In Kubernetes clusters using Ceph RBD as a storage provisioner, with a logging level of at least 4, Ceph RBD admin secret...

Kubernetes: secret leaks in vsphere cloud controller manager log

Report Submission Form Summary: When create k8s cluster over vsphere and enable vsphere as cloud provider. With logging level set to 4 or above, secret information will be printed out in the cloud controller manager's log. Kubernetes Version: 1.18.6 Component Version: legacy cloud provider Steps ...

Information Exposure in Snyk Broker

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG...

Information Disclosure

snyk-broker is vulnerable to information disclosure. The vulnerability exists because it does not prevent the leakage of origin information in the function bunyan.createLogger, allowing the attacker to get the sensitive information from the logs as it stores private keys with logging level settin...

CVE-2020-7654: Insertion of Sensitive Information into Log File

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG...

PT-2020-19686

Name of the Vulnerable Software and Affected Versions snyk-broker versions prior to 4.73.1 Description The issue concerns information exposure where private keys are logged if the logging level is set to DEBUG. Recommendations For versions prior to 4.73.1, update to version 4.73.1 or later to...

CVE-2020-2004

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

CVE-2020-1987

An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versio...

ansible: secrets disclosed on logs when no_log enabled

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...

CVE-2019-11293

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...

CVE-2019-14846

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...

CVE-2019-11276

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent...

PT-2019-12223

Name of the Vulnerable Software and Affected Versions Pivotal Application Service versions 2.3.x through 2.3.15 Pivotal Application Service versions 2.4.x through 2.4.11 Pivotal Application Service versions 2.5.x through 2.5.7 Pivotal Application Service versions 2.6.x through 2.6.2 Description T...