Symlink Attack in kubectl cp

🗓️ 15 Feb 2022 01:57:18Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 127 Views

Symlink attack in kubectl cp command, allowing malicious code to write files on user machin

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Kubernetes (CVE-2019-11247, CVE-2019-11249)	23 Nov 201916:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by kubectl vulnerabilities	12 Jul 201913:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	1 Sep 202514:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private for Data is affected multiple security vulnerabilities in IBM Cloud Private Kubernetes	3 Oct 201922:50	–	ibm
IBM Security Bulletins	Security Bulletin: API Connect V2018 is impacted by a directory traversal vulnerability in Kubernetes (CVE-2019-1002101)	19 May 201914:45	–	ibm
IBM Security Bulletins	Security Bulletin: InfoSphere Information Server is affected by multiple vulnerabilities in Kubernetes	18 May 202021:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM Cloud Private Kubernetes	15 May 201920:55	–	ibm

Vulners

Node

k8s.io kubernetesRange1.13.0–1.13.5go

k8s.io kubernetesRange1.12.0–1.12.7go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-1002101
github	www.github.com/kubernetes/kubernetes/pull/75037
github	www.github.com/kubernetes/kubernetes/commit/47063891dd782835170f500a83f37cc98c3c1013
access	www.access.redhat.com/errata/RHBA-2019:0619
access	www.access.redhat.com/errata/RHBA-2019:0620
access	www.access.redhat.com/errata/RHBA-2019:0636
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/BPV2RE5RMOGUVP5WJMXKQJZUBBLAFZPZ/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QZB7E3DOZ5WDG46XAIU6K32CXHXPXB2F/
twistlock	www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/
openwall	www.openwall.com/lists/oss-security/2019/06/21/1

18 Sep 2023 19:40Current

1.5Low risk

Vulners AI Score1.5

CVSS 35.5 - 6.4

CVSS 25.8

EPSS0.49935