CVE-2020-8564: kubernetes
CVSS: 5.5v3.1MediumModified
AliasesRHSA-2021:3193UBUNTU-CVE-2020-8564DEBIAN-CVE-2020-8564CGA-6pqx-8q63-85x7CGA-9pr3-ww97-2hhhCGA-g4rg-7qj3-ghrcCGA-g667-xm4r-g9x2CGA-vx2p-v9q5-gxg7CGA-x257-j9hg-hwqqGHSA-8mjg-8c8g-6h85GO-2021-0066
Published 07-12-2020Last modified 16-09-2024
Vulnerability summary
CVE-2020-8564 is a medium (CVSS 5.5) vulnerability in kubernetes. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.1% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.47%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 5Timeline
- 07-12-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
CVSS metrics
9 scores · 8 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSources8 sources · 4.7–5.5
- CVE.orgCNA4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 20-09-2026
20-09-202620-10-2026
EPSS score0.47%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat13 products
- atomic-openshift< 0:3.11.501-1.git.0.f8c4746.el7
- atomic-openshift-clients< 0:3.11.501-1.git.0.f8c4746.el7
- atomic-openshift-clients-redistributable< 0:3.11.501-1.git.0.f8c4746.el7
- atomic-openshift-docker-excluder< 0:3.11.501-1.git.0.f8c4746.el7
- atomic-openshift-excluder< 0:3.11.501-1.git.0.f8c4746.el7
Chainguard3 products
- kubeflow-pipelinesAll versions (No fix recorded)
- nodetaintAll versions (No fix recorded)
- spark-operator< 1.1.27-r17
Wolfi3 products
- kubeflow-pipelinesAll versions (No fix recorded)
- nodetaintAll versions (No fix recorded)
- spark-operator< 1.1.27-r17
Debian1 product
- kubernetes< 1.19.3-1
Github.com/kubernetes1 product
- kubernetes≥ 1.19.0, < 1.19.3 | ≥ 1.18.0, < 1.18.10 | < 1.17.13
K8s.io1 product
- kubernetes< 1.20.0-alpha.1
Kubernetes1 product
- kubernetes< 1.19.3 | < 1.18.10 | < 1.17.13 | ≥ 1.17.0, < 1.17.13 | ≥ 1.18.0, < 1.18.10 | ≥ 1.19.0, < 1.19.3
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
8 vendors · 24 products
References
25 links- groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJMailing ListX Refsource MLISTFIXWEBPatchThird Party Advisory
- github.com/kubernetes/kubernetes/issues/95622X Refsource CONFIRMARTICLEREPORTAdvisoryWEBThird Party Advisory
