Description (CNA)
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kubernetes / Kubernetes | affected v1.5.x; affected v1.6.x; affected v1.7.x; affected v1.8.x; affected unspecified before v1.9.6 |
CWE
No CWE identifiers supplied.
References
- https://github.com/kubernetes/kubernetes/issues/61297
- https://hansmi.ch/articles/2018-04-openshift-s2i-security
- https://bugzilla.redhat.com/show_bug.cgi?id=1564305
ADP enrichment
No English description supplied.