Riskcovery

CVE-2019-11251

kubectl cp allows symlink directory traversal

State
Published
Severity
4.8 Medium
Published
Feb 3, 2020
Updated
Aug 4, 2024
Reserved
Apr 17, 2019

Read the record on cve.org

Description

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:Nkubernetes

Weaknesses

  • CWE-61 UNIX Symbolic Link (Symlink) Following

Affected Products

ProductVersions
KubernetesKubernetes
  • prior to 1.13.11Affected
  • prior to 1.14.7Affected
  • prior to 1.15.4Affected
  • 1.1Affected
  • 1.2Affected
  • 1.3Affected
  • 1.4Affected
  • 1.5Affected
  • 1.6Affected
  • 1.7Affected
  • 1.8Affected
  • 1.9Affected
  • 1.10Affected
  • 1.11Affected
  • 1.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.