CVE-2018-1002100: Improper Input Validation

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

PT-2018-9619

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.5.x through 1.9.5 Description: The issue concerns the insecure handling of tar data by the kubectl cp command, which can lead to the overwrite of arbitrary local files. This is a result of how the command manages data...

Kubectl copy doesn't check for paths outside of it's destination directory.

Is this a BUG REPORT or FEATURE REQUEST?: Bug /kind bug What happened: kubectl cp :/some/remote/dir /some/local/dir If the container returns a malformed tarfile with paths like: '/some/remote/dir/../../../../tmp/foo' kubectl writes this to /tmp/foo instead of /some/local/dir/tmp/foo What you...