Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist.
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Laf | Laf | 0.1.5 (including) | 0.1.5 (including) |
| Laf | Laf | 0.4.0 (including) | 0.4.0 (including) |
| Laf | Laf | 0.4.1 (including) | 0.4.1 (including) |
| Laf | Laf | 0.4.2 (including) | 0.4.2 (including) |
| Laf | Laf | 0.4.3 (including) | 0.4.3 (including) |
| Laf | Laf | 0.4.4 (including) | 0.4.4 (including) |
| Laf | Laf | 0.4.5 (including) | 0.4.5 (including) |
| Laf | Laf | 0.4.6 (including) | 0.4.6 (including) |
| Laf | Laf | 0.4.7 (including) | 0.4.7 (including) |
| Laf | Laf | 0.4.8 (including) | 0.4.8 (including) |
| Laf | Laf | 0.4.9 (including) | 0.4.9 (including) |
| Laf | Laf | 0.4.10 (including) | 0.4.10 (including) |
| Laf | Laf | 0.4.11 (including) | 0.4.11 (including) |
| Laf | Laf | 0.4.12 (including) | 0.4.12 (including) |
| Laf | Laf | 0.4.13 (including) | 0.4.13 (including) |
| Laf | Laf | 0.4.14 (including) | 0.4.14 (including) |
| Laf | Laf | 0.4.15 (including) | 0.4.15 (including) |
| Laf | Laf | 0.4.16 (including) | 0.4.16 (including) |
| Laf | Laf | 0.4.17 (including) | 0.4.17 (including) |
| Laf | Laf | 0.4.18 (including) | 0.4.18 (including) |
| Laf | Laf | 0.4.19 (including) | 0.4.19 (including) |
| Laf | Laf | 0.4.20 (including) | 0.4.20 (including) |
| Laf | Laf | 0.4.21-alpha0 (including) | 0.4.21-alpha0 (including) |
| Laf | Laf | 0.5.0 (including) | 0.5.0 (including) |
| Laf | Laf | 0.5.0-alpha0 (including) | 0.5.0-alpha0 (including) |
| Laf | Laf | 0.5.0-alpha1 (including) | 0.5.0-alpha1 (including) |
| Laf | Laf | 0.5.0-alpha2 (including) | 0.5.0-alpha2 (including) |
| Laf | Laf | 0.5.0-alpha3 (including) | 0.5.0-alpha3 (including) |
| Laf | Laf | 0.5.1 (including) | 0.5.1 (including) |
| Laf | Laf | 0.5.1-alpha0 (including) | 0.5.1-alpha0 (including) |
| Laf | Laf | 0.5.2 (including) | 0.5.2 (including) |
| Laf | Laf | 0.5.2-alpha0 (including) | 0.5.2-alpha0 (including) |
| Laf | Laf | 0.5.3 (including) | 0.5.3 (including) |
| Laf | Laf | 0.5.4 (including) | 0.5.4 (including) |
| Laf | Laf | 0.5.4-alpha0 (including) | 0.5.4-alpha0 (including) |
| Laf | Laf | 0.5.5 (including) | 0.5.5 (including) |
| Laf | Laf | 0.5.5-alpha0 (including) | 0.5.5-alpha0 (including) |
| Laf | Laf | 0.5.6 (including) | 0.5.6 (including) |
| Laf | Laf | 0.5.7 (including) | 0.5.7 (including) |
| Laf | Laf | 0.5.7-alpha0 (including) | 0.5.7-alpha0 (including) |
| Laf | Laf | 0.5.8-alpha0 (including) | 0.5.8-alpha0 (including) |
| Laf | Laf | 0.6.0 (including) | 0.6.0 (including) |
| Laf | Laf | 0.6.0-alpha0 (including) | 0.6.0-alpha0 (including) |
| Laf | Laf | 0.6.0-alpha1 (including) | 0.6.0-alpha1 (including) |
| Laf | Laf | 0.6.0-alpha10 (including) | 0.6.0-alpha10 (including) |
| Laf | Laf | 0.6.0-alpha2 (including) | 0.6.0-alpha2 (including) |
| Laf | Laf | 0.6.0-alpha3 (including) | 0.6.0-alpha3 (including) |
| Laf | Laf | 0.6.0-alpha4 (including) | 0.6.0-alpha4 (including) |
| Laf | Laf | 0.6.0-alpha5 (including) | 0.6.0-alpha5 (including) |
| Laf | Laf | 0.6.0-alpha6 (including) | 0.6.0-alpha6 (including) |
| Laf | Laf | 0.6.0-alpha7 (including) | 0.6.0-alpha7 (including) |
| Laf | Laf | 0.6.0-alpha8 (including) | 0.6.0-alpha8 (including) |
| Laf | Laf | 0.6.0-alpha9 (including) | 0.6.0-alpha9 (including) |
| Laf | Laf | 0.6.1 (including) | 0.6.1 (including) |
| Laf | Laf | 0.6.2 (including) | 0.6.2 (including) |
| Laf | Laf | 0.6.3 (including) | 0.6.3 (including) |
| Laf | Laf | 0.6.4 (including) | 0.6.4 (including) |
| Laf | Laf | 0.6.5 (including) | 0.6.5 (including) |
| Laf | Laf | 0.6.6 (including) | 0.6.6 (including) |
| Laf | Laf | 0.6.7 (including) | 0.6.7 (including) |
| Laf | Laf | 0.6.8 (including) | 0.6.8 (including) |
| Laf | Laf | 0.6.9 (including) | 0.6.9 (including) |
| Laf | Laf | 0.6.10 (including) | 0.6.10 (including) |
| Laf | Laf | 0.6.11 (including) | 0.6.11 (including) |
| Laf | Laf | 0.6.12 (including) | 0.6.12 (including) |
| Laf | Laf | 0.6.13 (including) | 0.6.13 (including) |
| Laf | Laf | 0.6.14 (including) | 0.6.14 (including) |
| Laf | Laf | 0.6.15 (including) | 0.6.15 (including) |
| Laf | Laf | 0.6.16 (including) | 0.6.16 (including) |
| Laf | Laf | 0.6.17 (including) | 0.6.17 (including) |
| Laf | Laf | 0.6.18 (including) | 0.6.18 (including) |
| Laf | Laf | 0.6.19 (including) | 0.6.19 (including) |
| Laf | Laf | 0.6.20 (including) | 0.6.20 (including) |
| Laf | Laf | 0.6.21 (including) | 0.6.21 (including) |
| Laf | Laf | 0.6.22 (including) | 0.6.22 (including) |
| Laf | Laf | 0.6.23 (including) | 0.6.23 (including) |
| Laf | Laf | 0.7.0 (including) | 0.7.0 (including) |
| Laf | Laf | 0.7.1 (including) | 0.7.1 (including) |
| Laf | Laf | 0.7.2 (including) | 0.7.2 (including) |
| Laf | Laf | 0.7.3 (including) | 0.7.3 (including) |
| Laf | Laf | 0.7.4 (including) | 0.7.4 (including) |
| Laf | Laf | 0.7.5 (including) | 0.7.5 (including) |
| Laf | Laf | 0.7.6 (including) | 0.7.6 (including) |
| Laf | Laf | 0.7.7 (including) | 0.7.7 (including) |
| Laf | Laf | 0.7.8 (including) | 0.7.8 (including) |
| Laf | Laf | 0.7.9 (including) | 0.7.9 (including) |
| Laf | Laf | 0.7.10 (including) | 0.7.10 (including) |
| Laf | Laf | 0.7.11 (including) | 0.7.11 (including) |
| Laf | Laf | 0.8.0 (including) | 0.8.0 (including) |
| Laf | Laf | 0.8.0-alpha0 (including) | 0.8.0-alpha0 (including) |
| Laf | Laf | 0.8.0-alpha1 (including) | 0.8.0-alpha1 (including) |
| Laf | Laf | 0.8.0-alpha10 (including) | 0.8.0-alpha10 (including) |
| Laf | Laf | 0.8.0-alpha11 (including) | 0.8.0-alpha11 (including) |
| Laf | Laf | 0.8.0-alpha2 (including) | 0.8.0-alpha2 (including) |
| Laf | Laf | 0.8.0-alpha3 (including) | 0.8.0-alpha3 (including) |
| Laf | Laf | 0.8.0-alpha4 (including) | 0.8.0-alpha4 (including) |
| Laf | Laf | 0.8.0-alpha5 (including) | 0.8.0-alpha5 (including) |
| Laf | Laf | 0.8.0-alpha6 (including) | 0.8.0-alpha6 (including) |
| Laf | Laf | 0.8.0-alpha7 (including) | 0.8.0-alpha7 (including) |
| Laf | Laf | 0.8.0-alpha8 (including) | 0.8.0-alpha8 (including) |
| Laf | Laf | 0.8.0-alpha9 (including) | 0.8.0-alpha9 (including) |
| Laf | Laf | 0.8.1 (including) | 0.8.1 (including) |
| Laf | Laf | 0.8.2 (including) | 0.8.2 (including) |
| Laf | Laf | 0.8.3 (including) | 0.8.3 (including) |
| Laf | Laf | 0.8.4 (including) | 0.8.4 (including) |
| Laf | Laf | 0.8.5 (including) | 0.8.5 (including) |
| Laf | Laf | 0.8.5-alpha0 (including) | 0.8.5-alpha0 (including) |
| Laf | Laf | 0.8.6 (including) | 0.8.6 (including) |
| Laf | Laf | 0.8.7 (including) | 0.8.7 (including) |
| Laf | Laf | 0.8.7-alpha0 (including) | 0.8.7-alpha0 (including) |
| Laf | Laf | 0.8.7-alpha1 (including) | 0.8.7-alpha1 (including) |
| Laf | Laf | 0.8.7-alpha2 (including) | 0.8.7-alpha2 (including) |
| Laf | Laf | 0.8.7-alpha3 (including) | 0.8.7-alpha3 (including) |
| Laf | Laf | 0.8.8 (including) | 0.8.8 (including) |
| Laf | Laf | 0.8.9 (including) | 0.8.9 (including) |
| Laf | Laf | 0.8.10 (including) | 0.8.10 (including) |
| Laf | Laf | 0.8.11 (including) | 0.8.11 (including) |
| Laf | Laf | 0.8.12 (including) | 0.8.12 (including) |
| Laf | Laf | 0.8.13 (including) | 0.8.13 (including) |
| Laf | Laf | 1.0.0-alpha0 (including) | 1.0.0-alpha0 (including) |
| Laf | Laf | 1.0.0-alpha1 (including) | 1.0.0-alpha1 (including) |
| Laf | Laf | 1.0.0-alpha2 (including) | 1.0.0-alpha2 (including) |
| Laf | Laf | 1.0.0-alpha3 (including) | 1.0.0-alpha3 (including) |
| Laf | Laf | 1.0.0-alpha4 (including) | 1.0.0-alpha4 (including) |
| Laf | Laf | 1.0.0-alpha5 (including) | 1.0.0-alpha5 (including) |
| Laf | Laf | 1.0.0-alpha6 (including) | 1.0.0-alpha6 (including) |
| Laf | Laf | 1.0.0-beta0 (including) | 1.0.0-beta0 (including) |
| Laf | Laf | 1.0.0-beta1 (including) | 1.0.0-beta1 (including) |
| Laf | Laf | 1.0.0-beta10 (including) | 1.0.0-beta10 (including) |
| Laf | Laf | 1.0.0-beta11 (including) | 1.0.0-beta11 (including) |
| Laf | Laf | 1.0.0-beta12 (including) | 1.0.0-beta12 (including) |
| Laf | Laf | 1.0.0-beta2 (including) | 1.0.0-beta2 (including) |
| Laf | Laf | 1.0.0-beta3 (including) | 1.0.0-beta3 (including) |
| Laf | Laf | 1.0.0-beta4 (including) | 1.0.0-beta4 (including) |
| Laf | Laf | 1.0.0-beta5 (including) | 1.0.0-beta5 (including) |
| Laf | Laf | 1.0.0-beta6 (including) | 1.0.0-beta6 (including) |
| Laf | Laf | 1.0.0-beta7 (including) | 1.0.0-beta7 (including) |
| Laf | Laf | 1.0.0-beta8 (including) | 1.0.0-beta8 (including) |
| Laf | Laf | 1.0.0-beta9 (including) | 1.0.0-beta9 (including) |
While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers. Different log files may be produced and stored for: