Path Traversal in the Java Kubernetes Client

2021-01-2918:12:54

Google

osv.dev

0.004 Low

EPSS

Percentile

72.2%

JSON

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.

CPENameOperatorVersion
io.kubernetes:client-javaeq8.0.0
io.kubernetes:client-javaeq4.0.0-beta1
io.kubernetes:client-javaeq3.0.0
io.kubernetes:client-javaeq8.0.0-alpha1
io.kubernetes:client-javaeq7.0.0
io.kubernetes:client-javaeq1.0.0-beta3
io.kubernetes:client-javaeq0.1
io.kubernetes:client-javaeq1.0.0-beta2
io.kubernetes:client-javaeq6.0.1
io.kubernetes:client-javaeq8.0.2

Name	Operator	Version
io.kubernetes:client-java	eq	8.0.0
io.kubernetes:client-java	eq	4.0.0-beta1
io.kubernetes:client-java	eq	3.0.0
io.kubernetes:client-java	eq	8.0.0-alpha1
io.kubernetes:client-java	eq	7.0.0
io.kubernetes:client-java	eq	1.0.0-beta3
io.kubernetes:client-java	eq	0.1
io.kubernetes:client-java	eq	1.0.0-beta2
io.kubernetes:client-java	eq	6.0.1
io.kubernetes:client-java	eq	8.0.2