Every CVE Search/ Get API key

CVE-2020-8564

Docker config secrets leaked when file is malformed and loglevel >= 4

4.7 MediumFix available

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.47%Down 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.7

Docker config secrets leaked when file is malformed and loglevel >= 4

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
CVE-2020-8564
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
EUVDEUVD-2023-0668 4.7

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
EUVD-2023-0668
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-8mjg-8c8g-6h85 4.7

Kubernetes Sensitive Information leak via Log File

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
GHSA-8mjg-8c8g-6h85
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
NVD 4.7

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
CVE-2020-8564
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSV 5.5

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
CVE-2020-8564
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-8564 5.5

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
DEBIAN-CVE-2020-8564
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-8mjg-8c8g-6h85 4.7

Kubernetes Sensitive Information leak via Log File

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
GHSA-8mjg-8c8g-6h85
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVRHSA-2020:4297 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update

Record
RHSA-2020:4297
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:0172 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.6.13 packages and security update

Record
RHSA-2021:0172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3193 5.3

Red Hat Security Advisory: OpenShift Container Platform 3.11.z security and bug fix update

Record
RHSA-2021:3193
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8564 4.7

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
UBUNTU-CVE-2020-8564
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2021-0066 No score

Sensitive information leak via log file in k8s.io/kubernetes

Attempting to read a malformed .dockercfg may cause secrets to be inappropriately logged.

Record
GO-2021-0066
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/kubernetes/kubernetes
Go
 1.19.0 up to 1.19.3
1.19.3
github.com/kubernetes/kubernetes
Go
 1.18.0 up to 1.18.10
1.18.10
github.com/kubernetes/kubernetes
Go
 before 1.17.13
1.17.13
k8s.io/kubernetes
Go
 before 1.20.0-alpha.1
1.20.0-alpha.1
kubernetes
Debian:12
 before 1.19.3-1
1.19.3-1
kubernetes
Debian:13
 before 1.19.3-1
1.19.3-1
kubernetes
Debian:14
 before 1.19.3-1
1.19.3-1
jenkins-2-plugins
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:4.6.1601368321-1.el8
0:4.6.1601368321-1.el8
openshift-clients
Red Hat:openshift:4.6::el7
From an advisory covering 9 CVEs
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7
0:4.6.0-202010081244.p0.git.3794.4743d24.el7
openshift-clients-redistributable
Red Hat:openshift:4.6::el7
From an advisory covering 9 CVEs
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7
0:4.6.0-202010081244.p0.git.3794.4743d24.el7
Show 41 moreShow less
Affected packages
PackageAffectedFixed
openshift-clients
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8
0:4.6.0-202010081244.p0.git.3794.4743d24.el8
openshift-clients-redistributable
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8
0:4.6.0-202010081244.p0.git.3794.4743d24.el8
containers-common
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
podman
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-debugsource
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-docker
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-remote
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-remote-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-tests
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
skopeo
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-debugsource
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-tests
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
runc
Red Hat:openshift:4.6::el7
From an advisory covering 9 CVEs
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el7
0:1.0.0-81.rhaos4.6.git5b757d4.el7
runc-debuginfo
Red Hat:openshift:4.6::el7
From an advisory covering 9 CVEs
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el7
0:1.0.0-81.rhaos4.6.git5b757d4.el7
runc
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
runc-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
runc-debugsource
Red Hat:openshift:4.6::el8
From an advisory covering 9 CVEs
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
openshift
Red Hat:openshift:4.6::el7
From an advisory covering 4 CVEs
 before 0:4.6.0-202101160934.p0.git.94242.fc5242e.el7
0:4.6.0-202101160934.p0.git.94242.fc5242e.el7
openshift-hyperkube
Red Hat:openshift:4.6::el7
From an advisory covering 4 CVEs
 before 0:4.6.0-202101160934.p0.git.94242.fc5242e.el7
0:4.6.0-202101160934.p0.git.94242.fc5242e.el7
openshift
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 0:4.6.0-202101160934.p0.git.94242.fc5242e.el8
0:4.6.0-202101160934.p0.git.94242.fc5242e.el8
openshift-hyperkube
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 0:4.6.0-202101160934.p0.git.94242.fc5242e.el8
0:4.6.0-202101160934.p0.git.94242.fc5242e.el8
containers-common
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 1:1.1.1-3.rhaos4.6.el8
1:1.1.1-3.rhaos4.6.el8
skopeo
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 1:1.1.1-3.rhaos4.6.el8
1:1.1.1-3.rhaos4.6.el8
skopeo-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 1:1.1.1-3.rhaos4.6.el8
1:1.1.1-3.rhaos4.6.el8
skopeo-debugsource
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 1:1.1.1-3.rhaos4.6.el8
1:1.1.1-3.rhaos4.6.el8
skopeo-tests
Red Hat:openshift:4.6::el8
From an advisory covering 4 CVEs
 before 1:1.1.1-3.rhaos4.6.el8
1:1.1.1-3.rhaos4.6.el8
atomic-openshift
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-clients
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-hyperkube
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-hypershift
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-master
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-node
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-pod
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7
atomic-openshift-tests
Red Hat:openshift:3.11::el7
 before 0:3.11.501-1.git.0.f8c4746.el7
0:3.11.501-1.git.0.f8c4746.el7

History

History
RecordedChangedSources
affected, facts
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8564 is a medium vulnerability (CVSS 4.7) in Kubernetes, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in github.com/kubernetes/kubernetes 1.19.3.

References

Show 67 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open