CVE-2019-11246

🗓️ 29 Aug 2019 00:23:54Reported by kubernetesType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 211 Views

The kubectl cp command in Kubernetes allows copying files between containers and the user machine, but is vulnerable to malicious code execution when unpacking tar archives

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Kubernetes (CVE-2019-11247, CVE-2019-11249)	23 Nov 201916:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Kubernetes (CVE-2019-11246)	19 Jul 201922:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision	20 Dec 201908:47	–	ibm
IBM Security Bulletins	Security Bulletin: API Connect V2018 is impacted by a Kubernetes vulnerability(CVE-2019-11246)	13 Aug 201919:59	–	ibm
ATTACKERKB	kubectl cp path traversal	1 Apr 201900:00	–	attackerkb
Circl	CVE-2019-11246	1 Dec 202520:45	–	circl
CNVD	Google Kubernetes Path Traversal Vulnerability	24 Jun 201900:00	–	cnvd

NVD

Node

kubernetes kubernetesRange1.0.0–1.12.10

kubernetes kubernetesRange1.13.0–1.13.9

kubernetes kubernetesRange1.14.0–1.14.5

kubernetes kubernetesRange1.15.0–1.15.2

kubernetes kubernetesMatch1.12.11beta0

[
  {
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 1.12.9"
      },
      {
        "status": "affected",
        "version": "prior to 1.13.6"
      },
      {
        "status": "affected",
        "version": "prior to 1.14.2"
      },
      {
        "status": "affected",
        "version": "1.1"
      },
      {
        "status": "affected",
        "version": "1.2"
      },
      {
        "status": "affected",
        "version": "1.4"
      },
      {
        "status": "affected",
        "version": "1.5"
      },
      {
        "status": "affected",
        "version": "1.6"
      },
      {
        "status": "affected",
        "version": "1.7"
      },
      {
        "status": "affected",
        "version": "1.8"
      },
      {
        "status": "affected",
        "version": "1.9"
      },
      {
        "status": "affected",
        "version": "1.10"
      },
      {
        "status": "affected",
        "version": "1.11"
      }
    ]
  }
]

Source	Link
github	www.github.com/kubernetes/kubernetes/pull/76788
security	www.security.netapp.com/advisory/ntap-20190919-0003/
groups	www.groups.google.com/forum/

21 Nov 2024 04:20Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.5

CVSS 36.4

EPSS0.00783