data/reports/GO-2021-0065.yaml

modules:
  - module: k8s.io/client-go
    versions:
      - fixed: 0.17.0
    vulnerable_at: 0.16.16-rc.0
    packages:
      - package: k8s.io/client-go/transport
        symbols:
          - debuggingRoundTripper.RoundTrip
        derived_symbols:
          - basicAuthRoundTripper.RoundTrip
          - bearerAuthRoundTripper.RoundTrip
          - impersonatingRoundTripper.RoundTrip
          - userAgentRoundTripper.RoundTrip
  - module: k8s.io/kubernetes
    versions:
      - fixed: 1.16.0-beta.1
    vulnerable_at: 1.16.0-beta.0
    packages:
      - package: k8s.io/kubernetes/staging/src/k8s.io/client-go/transport
        symbols:
          - debuggingRoundTripper.RoundTrip
        skip_fix: 'TODO: revisit this reason (module does not contain package k8s.io/kubernetes/staging/src/k8s.io/client-go/transport)'
description: |
    Authorization tokens may be inappropriately logged if the verbosity
    level is set to a debug level.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2019-11250
ghsas:
  - GHSA-jmrx-5g74-6v2f
references:
  - fix: https://github.com/kubernetes/kubernetes/pull/81330
  - fix: https://github.com/kubernetes/kubernetes/commit/4441f1d9c3e94d9a3d93b4f184a591cab02a5245
  - web: https://github.com/kubernetes/kubernetes/issues/81114