Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-0436

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration:  DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

Published

2023-11-07T12:15:08.067

Last Modified

2024-11-21T07:37:10.633

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-532
  • Type: Primary
    CWE-532
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mongodb atlas_kubernetes_operator < 1.7.1 Yes
Application mongodb atlas_kubernetes_operator 1.5.0 Yes
References