description: In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
problem types: directory traversal vulnerability
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: v1.5.x
status: affected, version: v1.6.x
status: affected, version: v1.7.x
status: affected, version: v1.8.x
lessThan: v1.9.6, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
version: 3.0
]