github.com/kubernetes/client-go-v0.17.3: 1 vulnerabilities (highest severity is: 5.5)

[mend-for-github-com]

Vulnerable Library - github.com/kubernetes/client-go-v0.17.3

Go client for Kubernetes.

Found in HEAD commit: b64ae757f88959311bae621aa93906de93a064b3

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-8565	Medium	5.5	github.com/kubernetes/client-go-v0.17.3	Direct	v1.20.0-alpha.2	❌

Details

CVE-2020-8565

Vulnerable Library - github.com/kubernetes/client-go-v0.17.3

Go client for Kubernetes.

Dependency Hierarchy:

• ❌ github.com/kubernetes/client-go-v0.17.3 (Vulnerable Library)

Found in HEAD commit: b64ae757f88959311bae621aa93906de93a064b3

Found in base branch: main

Vulnerability Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

Publish Date: 2020-12-07

URL: CVE-2020-8565

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2020-0064

Release Date: 2020-12-07

Fix Resolution: v1.20.0-alpha.2