CVE-2020-8565: 
NixOS vulnerability analysis and mitigation

CVE-2020-8565 is a security vulnerability in Kubernetes that allows authorization and bearer tokens to be written to log files when the logging level is set to at least 9. This vulnerability affects both API server logs and client tool output like kubectl. The affected versions include Kubernetes versions <= v1.19.3, <= v1.18.10, <= v1.17.13, and < v1.20.0-alpha2 (Kubernetes Issue).

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File) with a CVSS v3.1 base score of 4.7 (Medium) and vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates a local attack vector with high attack complexity, requiring low privileges and no user interaction, potentially resulting in high confidentiality impact but no integrity or availability impact (NVD Database).

When verbose logging is enabled (log level >= 9), the vulnerability can expose sensitive Kubernetes authorization tokens, including bearer tokens and basic authentication credentials in log files. This exposure occurs in both server-side components and client tools (Kubernetes Mailing List).

The vulnerability requires local access to the system and the logging level to be set at 9 or higher. The attack complexity is considered high, and the attacker needs low privileges to exploit the vulnerability. The exposure can occur in both Kubernetes server-side components (kube-apiserver) and client tools like kubectl (NVD Database).

The primary mitigation strategies include not enabling verbose logging in production environments and limiting access to log files. The vulnerability has been fixed in Kubernetes versions v1.20.0, v1.19.6, v1.18.14, and v1.17.16. Users are recommended to upgrade to these or later versions. If exposed secrets are found in log files, they should be rotated as soon as possible (Kubernetes Issue, Kubernetes Mailing List).