{"id":"GHSA-g35x-j6jj-8g7j","aliases":[],"url":"https://o3.security/vulnerability/GHSA-g35x-j6jj-8g7j","summary":"@mittwald/kubernetes's secret contents leaked via debug logging","details":"### Impact\n\nWhen debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources.\n\nWhen running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere).\n\n### Patches\nUpgrade to 3.5.0 or newer.\n\n### Workarounds\nDisable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`).\n\n### References\n\n- https://cwe.mitre.org/data/definitions/532.html\n","published":"2023-05-02T16:51:25Z","modified":"2023-05-02T16:51:25Z","cvss":{"score":4.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@mittwald/kubernetes","fixedVersion":"3.5.0"}],"fix":{"url":"https://github.com/mittwald/node-kubernetes/commit/04f6809fd438417c343d541e57f76f0040e069cd","label":"mittwald/node-kubernetes@04f6809"},"references":[{"type":"WEB","url":"https://github.com/mittwald/node-kubernetes/security/advisories/GHSA-g35x-j6jj-8g7j"},{"type":"WEB","url":"https://github.com/mittwald/node-kubernetes/commit/04f6809fd438417c343d541e57f76f0040e069cd"},{"type":"PACKAGE","url":"https://github.com/mittwald/node-kubernetes"},{"type":"WEB","url":"https://github.com/mittwald/node-kubernetes/releases/tag/v3.5.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-05-02T16:51:25Z"}}