CVE-2019-11252
5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Summary
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Kubernetes | Kubernetes | 1.16 | affected |
| Kubernetes | Kubernetes | 1.17 | affected |
| Kubernetes | Kubernetes | 1.6 | affected |
| Kubernetes | Kubernetes | 1.7 | affected |
| Kubernetes | Kubernetes | 1.8 | affected |
| Kubernetes | Kubernetes | 1.9 | affected |
| Kubernetes | Kubernetes | 1.10 | affected |
| Kubernetes | Kubernetes | 1.11 | affected |
| Kubernetes | Kubernetes | 1.12 | affected |
| Kubernetes | Kubernetes | 1.13 | affected |
| Kubernetes | Kubernetes | 1.14 | affected |
| Kubernetes | Kubernetes | 1.15 | affected |
Weaknesses
- CWE-209: CWE-209 Information Exposure Through an Error Message
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.