CVE-2018-1002100: Input Validation
First published: Fri Apr 06 2018(Updated: )
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Credit: jordan@liggitt.net jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/k8s.io/kubernetes | >=1.5<1.9.6 | 1.9.6 |
| Kubernetes Kubernetes | >=1.5.0<=1.5.9 | |
| Kubernetes Kubernetes | >=1.6.0<=1.6.14 | |
| Kubernetes Kubernetes | >=1.7.0<=1.7.17 | |
| Kubernetes Kubernetes | >=1.8.0<=1.8.15 | |
| Kubernetes Kubernetes | >=1.9.0<=1.9.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2018-1002100
- https://github.com/kubernetes/kubernetes/issues/61297
- https://bugzilla.redhat.com/show_bug.cgi?id=1564305
- https://hansmi.ch/articles/2018-04-openshift-s2i-security
- https://github.com/advisories/GHSA-2jq6-ffph-p4h8 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1564307
- https://access.redhat.com/security/cve/cve-2018-1002100
- https://access.redhat.com/security/cve/CVE-2018-1002100
Frequently Asked Questions
What is CVE-2018-1002100?
CVE-2018-1002100 is a vulnerability in Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6 that allows the kubectl cp command to insecurely handle tar data returned from the container, potentially overwriting arbitrary local files.
How severe is CVE-2018-1002100?
CVE-2018-1002100 has a severity rating of 5.5 (medium).
How can I fix CVE-2018-1002100?
To fix CVE-2018-1002100, upgrade to Kubernetes version 1.9.6 or later.
Which software versions are affected by CVE-2018-1002100?
Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6 are affected by CVE-2018-1002100.
Where can I find more information about CVE-2018-1002100?
You can find more information about CVE-2018-1002100 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-1002100), [GitHub](https://github.com/kubernetes/kubernetes/issues/61297), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1564305).
- collector/github-advisory-latest
- alias/GHSA-2jq6-ffph-p4h8
- alias/CVE-2018-1002100
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/tags
- agent/event
- package-manager/go
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.5.0
- version/kubernetes kubernetes/1.5.9
- version/kubernetes kubernetes/1.6.0
- version/kubernetes kubernetes/1.6.14
- version/kubernetes kubernetes/1.7.0
- version/kubernetes kubernetes/1.7.17
- version/kubernetes kubernetes/1.8.0
- version/kubernetes kubernetes/1.8.15
- version/kubernetes kubernetes/1.9.0
- version/kubernetes kubernetes/1.9.5
- package-manager/redhat