SB2023120683 - IBM Cloud Pak for Data Scheduling update for kubectl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023120683

SB2023120683 - IBM Cloud Pak for Data Scheduling update for kubectl

Published: December 6, 2023

Security Bulletin ID SB2023120683
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Unprotected storage of credentials (CVE-ID: CVE-2019-11250)

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.


Remediation

Install update from vendor's website.

References