summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--recipes-containers/kubernetes/kubernetes/CVE-2020-8565.patch24
-rw-r--r--recipes-containers/kubernetes/kubernetes/CVE-2020-8566.patch67
-rw-r--r--recipes-containers/kubernetes/kubernetes_git.bb2
3 files changed, 93 insertions, 0 deletions
diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2020-8565.patch b/recipes-containers/kubernetes/kubernetes/CVE-2020-8565.patch
new file mode 100644
index 00000000..c3772e91
--- /dev/null
+++ b/recipes-containers/kubernetes/kubernetes/CVE-2020-8565.patch
@@ -0,0 +1,24 @@
1From f0f52255412cbc6834bd225a59608ebb4a0d399b Mon Sep 17 00:00:00 2001
2From: Sam Fowler <sfowler@redhat.com>
3Date: Tue, 6 Oct 2020 11:10:38 +1000
4Subject: [PATCH] Mask bearer token in logs when logLevel >= 9
5
6Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/f0f52255412cbc6834bd225a59608ebb4a0d399b]
7CVE: CVE-2020-8565
8Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
9---
10 staging/src/k8s.io/client-go/transport/round_trippers.go | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/staging/src/k8s.io/client-go/transport/round_trippers.go b/staging/src/k8s.io/client-go/transport/round_trippers.go
14index a05208d924d3b..f4cfadbd3da8e 100644
15--- a/src/import/staging/src/k8s.io/client-go/transport/round_trippers.go
16+++ b/src/import/staging/src/k8s.io/client-go/transport/round_trippers.go
17@@ -340,6 +340,7 @@ func (r *requestInfo) toCurl() string {
18 headers := ""
19 for key, values := range r.RequestHeaders {
20 for _, value := range values {
21+ value = maskValue(key, value)
22 headers += fmt.Sprintf(` -H %q`, fmt.Sprintf("%s: %s", key, value))
23 }
24 }
diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2020-8566.patch b/recipes-containers/kubernetes/kubernetes/CVE-2020-8566.patch
new file mode 100644
index 00000000..7ed812d5
--- /dev/null
+++ b/recipes-containers/kubernetes/kubernetes/CVE-2020-8566.patch
@@ -0,0 +1,67 @@
1From e91ec4fad3366d2dee020919f7c2a0d7b52fd3ea Mon Sep 17 00:00:00 2001
2From: Sam Fowler <sfowler@redhat.com>
3Date: Fri, 2 Oct 2020 10:48:11 +1000
4Subject: [PATCH] Mask Ceph RBD adminSecrets in logs when logLevel >= 4
5
6Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/e91ec4fad3366d2dee020919f7c2a0d7b52fd3ea]
7CVE: CVE-2020-8566
8Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
9---
10 pkg/volume/rbd/rbd_util.go | 12 ++++++------
11 1 file changed, 6 insertions(+), 6 deletions(-)
12
13diff --git a/pkg/volume/rbd/rbd_util.go b/pkg/volume/rbd/rbd_util.go
14index 85044e85fde..9593348de37 100644
15--- a/src/import/pkg/volume/rbd/rbd_util.go
16+++ b/src/import/pkg/volume/rbd/rbd_util.go
17@@ -592,9 +592,9 @@ func (util *RBDUtil) CreateImage(p *rbdVolumeProvisioner) (r *v1.RBDPersistentVo
18 volSz := fmt.Sprintf("%d", sz)
19 mon := util.kernelRBDMonitorsOpt(p.Mon)
20 if p.rbdMounter.imageFormat == rbdImageFormat2 {
21- klog.V(4).Infof("rbd: create %s size %s format %s (features: %s) using mon %s, pool %s id %s key %s", p.rbdMounter.Image, volSz, p.rbdMounter.imageFormat, p.rbdMounter.imageFeatures, mon, p.rbdMounter.Pool, p.rbdMounter.adminId, p.rbdMounter.adminSecret)
22+ klog.V(4).Infof("rbd: create %s size %s format %s (features: %s) using mon %s, pool %s id %s key <masked>", p.rbdMounter.Image, volSz, p.rbdMounter.imageFormat, p.rbdMounter.imageFeatures, mon, p.rbdMounter.Pool, p.rbdMounter.adminId)
23 } else {
24- klog.V(4).Infof("rbd: create %s size %s format %s using mon %s, pool %s id %s key %s", p.rbdMounter.Image, volSz, p.rbdMounter.imageFormat, mon, p.rbdMounter.Pool, p.rbdMounter.adminId, p.rbdMounter.adminSecret)
25+ klog.V(4).Infof("rbd: create %s size %s format %s using mon %s, pool %s id %s key <masked>", p.rbdMounter.Image, volSz, p.rbdMounter.imageFormat, mon, p.rbdMounter.Pool, p.rbdMounter.adminId)
26 }
27 args := []string{"create", p.rbdMounter.Image, "--size", volSz, "--pool", p.rbdMounter.Pool, "--id", p.rbdMounter.adminId, "-m", mon, "--key=" + p.rbdMounter.adminSecret, "--image-format", p.rbdMounter.imageFormat}
28 if p.rbdMounter.imageFormat == rbdImageFormat2 {
29@@ -629,7 +629,7 @@ func (util *RBDUtil) DeleteImage(p *rbdVolumeDeleter) error {
30 }
31 // rbd rm.
32 mon := util.kernelRBDMonitorsOpt(p.rbdMounter.Mon)
33- klog.V(4).Infof("rbd: rm %s using mon %s, pool %s id %s key %s", p.rbdMounter.Image, mon, p.rbdMounter.Pool, p.rbdMounter.adminId, p.rbdMounter.adminSecret)
34+ klog.V(4).Infof("rbd: rm %s using mon %s, pool %s id %s key <masked>", p.rbdMounter.Image, mon, p.rbdMounter.Pool, p.rbdMounter.adminId)
35 output, err = p.exec.Command("rbd",
36 "rm", p.rbdMounter.Image, "--pool", p.rbdMounter.Pool, "--id", p.rbdMounter.adminId, "-m", mon, "--key="+p.rbdMounter.adminSecret).CombinedOutput()
37 if err == nil {
38@@ -661,7 +661,7 @@ func (util *RBDUtil) ExpandImage(rbdExpander *rbdVolumeExpander, oldSize resourc
39
40 // rbd resize.
41 mon := util.kernelRBDMonitorsOpt(rbdExpander.rbdMounter.Mon)
42- klog.V(4).Infof("rbd: resize %s using mon %s, pool %s id %s key %s", rbdExpander.rbdMounter.Image, mon, rbdExpander.rbdMounter.Pool, rbdExpander.rbdMounter.adminId, rbdExpander.rbdMounter.adminSecret)
43+ klog.V(4).Infof("rbd: resize %s using mon %s, pool %s id %s key <masked>", rbdExpander.rbdMounter.Image, mon, rbdExpander.rbdMounter.Pool, rbdExpander.rbdMounter.adminId)
44 output, err = rbdExpander.exec.Command("rbd",
45 "resize", rbdExpander.rbdMounter.Image, "--size", newVolSz, "--pool", rbdExpander.rbdMounter.Pool, "--id", rbdExpander.rbdMounter.adminId, "-m", mon, "--key="+rbdExpander.rbdMounter.adminSecret).CombinedOutput()
46 if err == nil {
47@@ -703,7 +703,7 @@ func (util *RBDUtil) rbdInfo(b *rbdMounter) (int, error) {
48 // # image does not exist (exit=2)
49 // rbd: error opening image 1234: (2) No such file or directory
50 //
51- klog.V(4).Infof("rbd: info %s using mon %s, pool %s id %s key %s", b.Image, mon, b.Pool, id, secret)
52+ klog.V(4).Infof("rbd: info %s using mon %s, pool %s id %s key <masked>", b.Image, mon, b.Pool, id)
53 output, err = b.exec.Command("rbd",
54 "info", b.Image, "--pool", b.Pool, "-m", mon, "--id", id, "--key="+secret, "-k=/dev/null", "--format=json").CombinedOutput()
55
56@@ -766,7 +766,7 @@ func (util *RBDUtil) rbdStatus(b *rbdMounter) (bool, string, error) {
57 // # image does not exist (exit=2)
58 // rbd: error opening image kubernetes-dynamic-pvc-<UUID>: (2) No such file or directory
59 //
60- klog.V(4).Infof("rbd: status %s using mon %s, pool %s id %s key %s", b.Image, mon, b.Pool, id, secret)
61+ klog.V(4).Infof("rbd: status %s using mon %s, pool %s id %s key <masked>", b.Image, mon, b.Pool, id)
62 cmd, err = b.exec.Command("rbd",
63 "status", b.Image, "--pool", b.Pool, "-m", mon, "--id", id, "--key="+secret).CombinedOutput()
64 output = string(cmd)
65--
662.25.1
67
diff --git a/recipes-containers/kubernetes/kubernetes_git.bb b/recipes-containers/kubernetes/kubernetes_git.bb
index c73f9882..2b0bfb7a 100644
--- a/recipes-containers/kubernetes/kubernetes_git.bb
+++ b/recipes-containers/kubernetes/kubernetes_git.bb
@@ -12,6 +12,8 @@ SRC_URI = "git://github.com/kubernetes/kubernetes.git;branch=release-1.17;name=k
12 file://0001-hack-lib-golang.sh-use-CC-from-environment.patch \ 12 file://0001-hack-lib-golang.sh-use-CC-from-environment.patch \
13 file://0001-cross-don-t-build-tests-by-default.patch \ 13 file://0001-cross-don-t-build-tests-by-default.patch \
14 file://CVE-2020-8564.patch \ 14 file://CVE-2020-8564.patch \
15 file://CVE-2020-8565.patch \
16 file://CVE-2020-8566.patch \
15 " 17 "
16 18
17DEPENDS += "rsync-native \ 19DEPENDS += "rsync-native \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-13 21:44:54 +0000