Skip to content
OpenAdvisories

Package · Go

k8s.io/client-go

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.7
    CVE-2020-8565

    Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

    In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-al…

    Kubernetes Kubernetes spark-operator newrelic-nri-statsd Debian Azure Linux Wolfi Go
  • Medium 4.7
    CVE-2019-11250

    Kubernetes client-go logs authorization headers at debug verbosity levels

    The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic …

    Kubernetes Kubernetes kubeflow-access-management k8s.io/kubernetes Debian Wolfi Go
  • Low 3.3
    CVE-2019-11244

    kubectl creates world-writeable cached schema files

    In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different locati…

    Kubernetes Kubernetes k8s.io/client-go Go