CVE-2018-1002100: Input Validation
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Other sources
When using kubectl to cp files to a pod, if the container returns a malformed tarfile with paths like, '/some/remote/dir/../../../../tmp/foo' kubectl writes this to /tmp/foo instead of /some/local/dir/tmp/foo.
https://github.com/kubernetes/kubernetes/issues/61297
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1002100?
CVE-2018-1002100 is a vulnerability in Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6 that allows the kubectl cp command to insecurely handle tar data returned from the container, potentially overwriting arbitrary local files.
How severe is CVE-2018-1002100?
CVE-2018-1002100 has a severity rating of 5.5 (medium).
How can I fix CVE-2018-1002100?
To fix CVE-2018-1002100, upgrade to Kubernetes version 1.9.6 or later.
Which software versions are affected by CVE-2018-1002100?
Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6 are affected by CVE-2018-1002100.
Where can I find more information about CVE-2018-1002100?
You can find more information about CVE-2018-1002100 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-1002100), [GitHub](https://github.com/kubernetes/kubernetes/issues/61297), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1564305).