id: GO-2022-0621
modules:
  - module: k8s.io/kube-state-metrics
    versions:
      - introduced: 1.7.0
        fixed: 1.7.2
    vulnerable_at: 1.7.0
    packages:
      - package: k8s.io/kube-state-metrics/internal/store
        symbols:
          - kubeAnnotationsToPrometheusLabels
summary: 'TODO(https://go.dev/issue/56443): fill in summary field'
description: |
    Exposing annotations as metrics can leak secrets.

    An experimental feature of kube-state-metrics enables annotations
    to be exposed as metrics. By default, metrics only expose metadata
    about secrets. However, a combination of the default kubectl behavior
    and this new feature can cause the entire secret content to end up
    in metric labels.
published: 2021-05-18T15:38:54Z
cves:
  - CVE-2019-10223
  - CVE-2019-17110
ghsas:
  - GHSA-2v6x-frw8-7r7f
  - GHSA-c92w-72c5-9x59
credits:
  - Moritz S.
references:
  - fix: https://github.com/kubernetes/kube-state-metrics/commit/03122fe3e2df49a9a7298b8af921d3c37c430f7f