Go/k8s.io/client-go CVE-2020-8565: medium 4.7, EPSS 0.52%

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

Action: Upgrade k8s.io/client-go to 0.17.16 or later.

go get k8s.io/client-go@v0.19.6

go get k8s.io/client-go@v0.20.0-alpha.2

go get k8s.io/client-go@v0.18.14

go get k8s.io/client-go@v0.17.16

Affected

Fixed versions

Sources

• osv: GHSA-8cfg-vx93-jvxw
• https://nvd.nist.gov/vuln/detail/CVE-2020-8565
• https://github.com/kubernetes/kubernetes/issues/95623
• https://github.com/kubernetes/kubernetes/pull/95316
• https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3
• https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0
• https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86
• https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373
• https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419
• https://github.com/kubernetes/client-go
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://pkg.go.dev/vuln/GO-2021-0064

CVE-2020-8565 · published 2023-02-06T23:27:56Z · modified 2026-09-10T03:49:51.898248948Z · JSON