CVE-2019-1002101

🗓️ 01 Apr 2019 14:14:27Reported by dwfType

The kubectl cp command in Kubernetes allows copying files between containers and the user machine. It has a vulnerability (CVE-2019-1002101) that could allow an attacker to write files to any path on the user's machine when kubectl cp is called

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Kubernetes (CVE-2019-11247, CVE-2019-11249)	23 Nov 201916:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by kubectl vulnerabilities	12 Jul 201913:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	1 Sep 202514:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private for Data is affected multiple security vulnerabilities in IBM Cloud Private Kubernetes	3 Oct 201922:50	–	ibm
IBM Security Bulletins	Security Bulletin: API Connect V2018 is impacted by a directory traversal vulnerability in Kubernetes (CVE-2019-1002101)	19 May 201914:45	–	ibm
IBM Security Bulletins	Security Bulletin: InfoSphere Information Server is affected by multiple vulnerabilities in Kubernetes	18 May 202021:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM Cloud Private Kubernetes	15 May 201920:55	–	ibm

NVD

Node

kubernetes kubernetesRange1.11.0–1.11.9

kubernetes kubernetesRange1.12.0–1.12.7

kubernetes kubernetesRange1.13.0–1.13.5

kubernetes kubernetesMatch1.14.0

Node

redhat openshift_container_platformMatch3.9

redhat openshift_container_platformMatch3.10

redhat openshift_container_platformMatch3.11

[
  {
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "status": "affected",
        "version": "1.1-1.10"
      },
      {
        "lessThan": "1.11.9",
        "status": "affected",
        "version": "1.11",
        "versionType": "custom"
      },
      {
        "lessThan": "1.12.7",
        "status": "affected",
        "version": "1.12",
        "versionType": "custom"
      },
      {
        "lessThan": "1.13.5",
        "status": "affected",
        "version": "1.13",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
twistlock	www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/
github	www.github.com/kubernetes/kubernetes/pull/75037
openwall	www.openwall.com/lists/oss-security/2019/08/05/5
securityfocus	www.securityfocus.com/bid/107652
access	www.access.redhat.com/errata/RHBA-2019:0620
openwall	www.openwall.com/lists/oss-security/2019/06/21/1
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QZB7E3DOZ5WDG46XAIU6K32CXHXPXB2F/
access	www.access.redhat.com/errata/RHBA-2019:0636
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPV2RE5RMOGUVP5WJMXKQJZUBBLAFZPZ/
access	www.access.redhat.com/errata/RHBA-2019:0619

21 Nov 2024 04:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 35.5 - 6.4

CVSS 25.8

EPSS0.49935

CWE-59