Kubernetes kubectl cp Vulnerable to Symlink Attack

🗓️ 18 May 2021 15:30:07Reported by GitHub Advisory DatabaseType

Kubernetes kubectl cp Vulnerable to Symlink Attac

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private - kubectl (CVE-2019-11251)	24 Dec 201916:32	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision	8 Jan 202016:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by a vulnerability in Kubernetes (CVE-2019-11251)	27 Jan 202023:25	–	ibm
BDU FSTEC	The vulnerability of the `kubectl cp` command, a management tool for clusters of virtual machines in Kubernetes, allows a attacker to upload a malicious file.	29 Oct 202000:00	–	bdu_fstec
CVE	CVE-2019-11251	3 Feb 202015:35	–	cve
Cvelist	CVE-2019-11251 kubectl cp allows symlink directory traversal	3 Feb 202015:35	–	cvelist
Debian CVE	CVE-2019-11251	3 Feb 202015:35	–	debiancve

Vulners

Node

k8s.io kubernetesRange1.15.3–1.16.0go

k8s.io kubernetesRange1.14.6–1.14.7go

k8s.io kubernetesRange1.13.10–1.13.11go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-11251
github	www.github.com/kubernetes/kubernetes/issues/87773
github	www.github.com/kubernetes/kubernetes/pull/82143
groups	www.groups.google.com/d/msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ
github	www.github.com/advisories/GHSA-6qfg-8799-r575

18 Sep 2023 20:30Current

6.4Medium risk

Vulners AI Score6.4

CVSS 24.3

CVSS 3.14.8 - 5.7

EPSS0.02327