The vulnerability of the `kubectl cp` command, a management tool for clusters of virtual machines in Kubernetes, allows a attacker to upload a malicious file.

🗓️ 29 Oct 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Flaw in kubectl cp allows remote upload and download of malicious files due to link misdefinition.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private - kubectl (CVE-2019-11251)	24 Dec 201916:32	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision	8 Jan 202016:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by a vulnerability in Kubernetes (CVE-2019-11251)	27 Jan 202023:25	–	ibm
CVE	CVE-2019-11251	3 Feb 202015:35	–	cve
Cvelist	CVE-2019-11251 kubectl cp allows symlink directory traversal	3 Feb 202015:35	–	cvelist
Debian CVE	CVE-2019-11251	3 Feb 202015:35	–	debiancve
Oracle linux	kubernetes security update	31 Jan 202000:00	–	oraclelinux

Vulners

Node

novell suse_caas_platformMatch3.0

OR

red_hat openshift_container_platformMatch4.1

OR

red_hat openshift_container_platformMatch3.11

OR

red_hat openshift_container_platformMatch3.9

OR

red_hat openshift_container_platformMatch3.10

OR

novell suse_caas_platformMatch1.0

OR

google kubernetesRange1.1–1.12

OR

google kubernetesRange<1.13.11

OR

google kubernetesRange<1.14.7

OR

google kubernetesRange<1.15.4

Source	Link
access	www.access.redhat.com/security/cve/CVE-2019-11251
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-11251
suse	www.suse.com/security/cve/CVE-2019-11251/
github	www.github.com/kubernetes/kubernetes/issues/87773
groups	www.groups.google.com/d/msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ
web	www.web.nvd.nist.gov/view/vuln/detail

29 Oct 2020 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 35.7

CVSS 27.1

EPSS0.02647

kubectl cp remote upload malicious files link misdefinition Kubernetes