nvd-json-data-feeds/CVE-2020/CVE-2020-85xx/CVE-2020-8564.json

{
  "id": "CVE-2020-8564",
  "sourceIdentifier": "jordan@liggitt.net",
  "published": "2020-12-07T22:15:21.307",
  "lastModified": "2024-11-21T05:39:02.430",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13."
    },
    {
      "lang": "es",
      "value": "En los cl\u00fasteres de Kubernetes que usan un nivel de registro de al menos 4, el procesamiento de un archivo de configuraci\u00f3n de docker malformado dar\u00e1 como resultado la filtraci\u00f3n del contenido del archivo de configuraci\u00f3n de docker, que puede incluir secretos de extracci\u00f3n u otras credenciales de registro. Esto afecta versiones anteriores a v1.19.3, versiones anteriores a v1.18.10, versiones anteriores a v1.17.13"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "jordan@liggitt.net",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6
      },
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "LOW",
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "jordan@liggitt.net",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.17.0",
              "versionEndExcluding": "1.17.13",
              "matchCriteriaId": "B765012B-C658-4EB8-956A-62A91142CE05"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.18.0",
              "versionEndExcluding": "1.18.10",
              "matchCriteriaId": "67F84BBA-5FCA-4A23-BB4E-47BE92E3706A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.19.0",
              "versionEndExcluding": "1.19.3",
              "matchCriteriaId": "456BD01B-44E8-4823-B220-5E109D8C377D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kubernetes/kubernetes/issues/95622",
      "source": "jordan@liggitt.net",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ",
      "source": "jordan@liggitt.net",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210122-0006/",
      "source": "jordan@liggitt.net",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/kubernetes/kubernetes/issues/95622",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210122-0006/",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}