| id: GO-2021-0065 |
| modules: |
| - module: k8s.io/client-go |
| versions: |
| - fixed: 0.17.0 |
| vulnerable_at: 0.16.16-rc.0 |
| packages: |
| - package: k8s.io/client-go/transport |
| symbols: |
| - debuggingRoundTripper.RoundTrip |
| derived_symbols: |
| - basicAuthRoundTripper.RoundTrip |
| - bearerAuthRoundTripper.RoundTrip |
| - impersonatingRoundTripper.RoundTrip |
| - userAgentRoundTripper.RoundTrip |
| - module: k8s.io/kubernetes |
| versions: |
| - fixed: 1.16.0-beta.1 |
| vulnerable_at: 1.16.0-beta.0 |
| packages: |
| - package: k8s.io/kubernetes/staging/src/k8s.io/client-go/transport |
| symbols: |
| - debuggingRoundTripper.RoundTrip |
| skip_fix: 'TODO: revisit this reason (module does not contain package k8s.io/kubernetes/staging/src/k8s.io/client-go/transport)' |
| summary: Unauthorized credential disclosure in k8s.io/kubernetes and k8s.io/client-go |
| description: |- |
| Authorization tokens may be inappropriately logged if the verbosity level is set |
| to a debug level. |
| published: 2021-04-14T20:04:52Z |
| cves: |
| - CVE-2019-11250 |
| ghsas: |
| - GHSA-jmrx-5g74-6v2f |
| references: |
| - fix: https://github.com/kubernetes/kubernetes/pull/81330 |
| - fix: https://github.com/kubernetes/kubernetes/commit/4441f1d9c3e94d9a3d93b4f184a591cab02a5245 |
| - web: https://github.com/kubernetes/kubernetes/issues/81114 |
