PT-2018-9619

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.5.x through 1.9.5 Description: The issue concerns the insecure handling of tar data by the kubectl cp command, which can lead to the overwrite of arbitrary local files. This is a result of how the command manages data...

Kubectl copy doesn't check for paths outside of it's destination directory.

Is this a BUG REPORT or FEATURE REQUEST?: Bug /kind bug What happened: kubectl cp :/some/remote/dir /some/local/dir If the container returns a malformed tarfile with paths like: '/some/remote/dir/../../../../tmp/foo' kubectl writes this to /tmp/foo instead of /some/local/dir/tmp/foo What you...