CVE-2020-8565: kubernetes
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2020-8565DEBIAN-CVE-2020-8565CGA-2xc2-cgjf-fj6gCGA-57jp-f3cf-4f43CGA-5fhw-c897-cg79CGA-8pqf-fqx8-xr29CGA-9h64-6pjr-6xcpCGA-9hff-www3-mwg5CGA-c935-rjfc-gm36CGA-m2hf-2ghg-mm2fCGA-qjg5-ppj4-rjj4CGA-rp87-q4mx-7863CGA-rv25-j5fr-q2j3CGA-wg6m-jm97-fg27GHSA-8cfg-vx93-jvxwGO-2021-0064CGA-9fvg-5x32-m43hCGA-j766-c36w-hvmpCGA-p56p-jrqp-86c6CGA-r7mj-244h-5fw3
Published 07-12-2020Last modified 17-09-2024
Vulnerability summary
CVE-2020-8565 is a medium (CVSS 5.5) vulnerability in kubernetes. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 5Timeline
- 07-12-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
CVSS metrics
8 scores · 7 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSources7 sources · 4.7–5.5
- CVE.orgCNA4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 20-09-2026
20-09-202620-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- gostatsd< 28.3.0-r33
- kubeflow-access-managementAll versions (No fix recorded)
- kubeflow-access-management-fipsAll versions (No fix recorded)
- kubeflow-pipelines< 2.2.0-r3
- kubernetes-secret-generatorAll versions (No fix recorded)
Wolfi6 products
- gostatsd< 28.3.0-r33
- kubeflow-access-managementAll versions (No fix recorded)
- kubeflow-pipelines< 2.2.0-r3
- newrelic-nri-statsd< 2.14.0-r2
- nodetaintAll versions (No fix recorded)
K8s.io2 products
- client-go≥ 0.19.0, < 0.19.6 | ≥ 0.20.0-alpha.0, < 0.20.0-alpha.2 | ≥ 0.18.0, < 0.18.14 | < 0.17.16 | < 0.20.0-alpha.2
- kubernetes< 1.20.0-alpha.2
Debian1 product
- kubernetes< 1.20.0-1
Kubernetes1 product
- kubernetes≤ 1.19.3 | ≤ 1.18.10 | ≤ 1.17.13 | < 1.20.0-alpha2 | ≥ 1.17.0, ≤ 1.17.13 | ≥ 1.18.0, ≤ 1.18.10 | ≥ 1.19.0, ≤ 1.19.3
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
6 vendors · 19 products
References
15 links- groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJMailing ListX Refsource MLISTFIXWEBPatchThird Party Advisory
- github.com/kubernetes/kubernetes/issues/95623X Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
