CVE-2018-1002100
CVE-2018-1002100
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
CVSS 4.2 · Medium · EPSS 1.7% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
kubernetes
- Versions
- v1.5.x: Affected
- v1.6.x: Affected
- v1.7.x: Affected
- v1.8.x: Affected
- ≥ unspecified, < v1.9.6: Affected (custom)
Update to v1.9.6
kubernetes Debian:12
- Affected ranges
- ECOSYSTEM: < 1.17.4-1
Update to 1.17.4-1
kubernetes Debian:13
- Affected ranges
- ECOSYSTEM: < 1.17.4-1
Update to 1.17.4-1
kubernetes Debian:14
- Affected ranges
- ECOSYSTEM: < 1.17.4-1
Update to 1.17.4-1