@mittwald/kubernetes's secret contents leaked via debug logging

published 2023-05-02 3y ago modified 2023-05-02 3y ago

cvss: 4.4; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

When debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources.

When running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere).

### Patches Upgrade to 3.5.0 or newer.

### Workarounds Disable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`).

### References

- https://cwe.mitre.org/data/definitions/532.html

Patch / fix

fixed in 1 links 2

npm @mittwald/kubernetes 3.5.0

Is GHSA-g35x-j6jj-8g7j in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	@mittwald/kubernetes	<3.5.0	3.5.0

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

References

Sources

GitHub Advisory GHSA-g35x-j6jj-8g7j

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.