CVE-2020-8566: Inclusion of Sensitive Information in Log Files

December 7, 2020 (updated March 29, 2021)

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager’s logs during provisioning of Ceph RBD persistent claims.

References

nvd.nist.gov/vuln/detail/CVE-2020-8566

Detect and mitigate CVE-2020-8566 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →