CVE-2019-10223 - kube-state-metrics: annotations exposed as metrics in combination with `kubectl` can allow for exposure of secrets

Back Back to CVE browser

MEDIUM

kube-state-metrics: annotations exposed as metrics in combination with `kubectl` can allow for exposure of secrets

Published Nov 5, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 1.78%

Description

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.

Affected products

Vendor Red Hat Product Kube-State-Metrics Default
n/a
- Version
  kube-state-metrics versions v1.7.0 and v1.7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat

Kube-State-Metrics

n/a

Version	Status	Constraints
kube-state-metrics versions v1.7.0 and v1.7.1	affected	-

Red Hat OpenShift Container Platform 3.11

openshift3/ose-kube-state-metrics

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-kube-state-metrics

Not affected

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 3.11	openshift3/ose-kube-state-metrics	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-kube-state-metrics	Not affected	n/a

github.com/kubernetes/kube-state-metrics

Go

Introduced 1.7.0 Fixed 1.7.2
k8s.io/kube-state-metrics

Go

Introduced 1.7.0 Fixed 1.7.2

Ecosystem	Package	Introduced	Fixed
Go	github.com/kubernetes/kube-state-metrics	1.7.0	1.7.2
Go	k8s.io/kube-state-metrics	1.7.0	1.7.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (12)

http://www.openwall.com/lists/oss-security/2019/08/15/8
mailing-listx_refsource_MLIST
https://access.redhat.com/security/cve/CVE-2019-10223
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1740431
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3542
Advisory
https://github.com/advisories/GHSA-c92w-72c5-9x59
Advisory
https://github.com/kubernetes/kube-state-metrics/commit/03122fe3e2df49a9a7298b8af921d3c37c430f7f
https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2019-10223
https://pkg.go.dev/vuln/GO-2022-0621
https://www.cve.org/CVERecord?id=CVE-2019-10223
https://www.openwall.com/lists/oss-security/2019/08/09/1
mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/08/15/8		mailing-listx_refsource_MLIST
https://access.redhat.com/security/cve/CVE-2019-10223		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1740431		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3542		Advisory
https://github.com/advisories/GHSA-c92w-72c5-9x59		Advisory
https://github.com/kubernetes/kube-state-metrics/commit/03122fe3e2df49a9a7298b8af921d3c37c430f7f
https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2019-10223
https://pkg.go.dev/vuln/GO-2022-0621
https://www.cve.org/CVERecord?id=CVE-2019-10223
https://www.openwall.com/lists/oss-security/2019/08/09/1		mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory