GHSA-2jq6-ffph-p4h8

ghsaUSosv

Kubernetes arbitrary file overwrite

view advisory published 2022-05-13Licence: CC-BY-4.0

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1002100US	medium5.5	1.67% (77th)	—	2018-06-02
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1564305WEB
https://github.com/kubernetes/kubernetesPACKAGE
https://github.com/kubernetes/kubernetes/issues/61297WEB
https://hansmi.ch/articles/2018-04-openshift-s2i-securityWEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1002100ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan