kubectl cp symlink vulnerability

🗓️ 03 Feb 2020 15:12:22Reported by Kubernetes Security Response CommitteeType

Kubectl cp symlink flaw allows escape via symlinks; vulnerable versions v1.13.10, v1.14.6, v1.15.3.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private - kubectl (CVE-2019-11251)	24 Dec 201916:32	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision	8 Jan 202016:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by a vulnerability in Kubernetes (CVE-2019-11251)	27 Jan 202023:25	–	ibm
BDU FSTEC	The vulnerability of the `kubectl cp` command, a management tool for clusters of virtual machines in Kubernetes, allows a attacker to upload a malicious file.	29 Oct 202000:00	–	bdu_fstec
CVE	CVE-2019-11251	3 Feb 202015:35	–	cve
Cvelist	CVE-2019-11251 kubectl cp allows symlink directory traversal	3 Feb 202015:35	–	cvelist
Debian CVE	CVE-2019-11251	3 Feb 202015:35	–	debiancve

03 Feb 2020 15:12Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

CVSS 3.14.8 - 5.7

EPSS0.02308