GitHub Advisoryadvisory · Go

GHSA-6qfg-8799-r575 Kubernetes kubectl cp Vulnerable to Symlink Attack

MEDIUM Published 2021-05-18 Modified 2023-09-18 Official page ↗
Aliases
CVE-2019-11251
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-59, CWE-61
Reviewed
2021-05-17

Affected packages

• Go k8s.io/kubernetes: >= 1.13.10, < 1.13.11 → fixed in 1.13.11 • Go k8s.io/kubernetes: >= 1.14.6, < 1.14.7 → fixed in 1.14.7 • Go k8s.io/kubernetes: >= 1.15.3, < 1.16.0 → fixed in 1.16.0

Description

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Related

Alias · CVE (1)

  • CVE-2019-11251 The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two… vulnerability

Weakness · CWE (2)

  • CWE-59 Improper Link Resolution Before File Access weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following weakness

References