{"id":"CVE-2019-11252","aliases":["DEBIAN-CVE-2019-11252","EUVD-2019-2945","RHSA-2020:2413"],"status":"published","title":"Credential leakage when failing to mount","description":"The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00967,"percentile":0.62045,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209"],"published":"2020-07-23T14:47:38Z","modified":"2026-10-24T10:50:34Z","fixes":[{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.18.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.18.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.18.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"machine-config-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.2527.d12c3da.el8"}]}],"bundled":5}],"products":[{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/pull/88684","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11252","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2413","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843358","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2413.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1860158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11254","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8558","tags":["advisory"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8945","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9283","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2019-11252","title":"Credential leakage when failing to mount","description":"The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.","status":"published","published":"2020-07-23T14:47:38.187Z","modified":"2024-09-17T04:24:20.027Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-2945","description":"The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.","status":"published","published":"2020-07-23T14:47:38Z","modified":"2024-09-17T04:24:20Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:23.50734Z"}],"nvd":[{"id":"CVE-2019-11252","description":"The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.","status":"published","published":"2020-07-23T15:15:11.93Z","modified":"2026-06-17T02:12:37.58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"CVE-2019-11252","description":"The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.","status":"published","published":"2020-07-23T15:15:11.93Z","modified":"2026-10-24T10:50:34.18032328Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-11252","description":"The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.","status":"published","published":"2020-07-23T15:15:11.93Z","modified":"2026-09-21T07:01:59.537236744Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2020:2413","title":"Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update","status":"published","published":"2024-09-30T13:54:06Z","modified":"2026-10-19T10:01:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"}]}}