GitHub Advisoryadvisory · Go

GHSA-2jq6-ffph-p4h8 Kubernetes arbitrary file overwrite

MEDIUM Published 2022-05-13 Modified 2026-01-16 Official page ↗
Aliases
CVE-2018-1002100
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2023-07-21

Affected packages

• Go k8s.io/kubernetes: >= 1.5.0-alpha.0, < 1.9.6 → fixed in 1.9.6

Description

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

Related

Alias · CVE (1)

  • CVE-2018-1002100 In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References