CVE-2019-11249: kubectl cp allows symlink directory traversal
First published: Mon Aug 05 2019(Updated: )
A third issue was discovered with the Kubernetes `kubectl cp` command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires user interaction to be exploited. This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the `kubectl cp` operation. The vulnerability is a client-side defect and requires user interaction to be exploited. Upstream Issue: <a href="https://github.com/kubernetes/kubernetes/issues/80984">https://github.com/kubernetes/kubernetes/issues/80984</a> External References: <a href="https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc">https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc</a>
Credit: jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kubernetes | <1.13.9 | 1.13.9 |
| redhat/kubernetes | <1.14.5 | 1.14.5 |
| redhat/kubernetes | <1.15.2 | 1.15.2 |
| redhat/kubernetes | <1.16.0 | 1.16.0 |
| redhat/atomic-openshift | <0:3.10.181-1.git.0.3ab4b3d.el7 | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| redhat/ansible-service-broker | <1:1.3.23-2.el7 | 1:1.3.23-2.el7 |
| redhat/atomic-openshift | <0:3.9.102-1.git.0.6411f52.el7 | 0:3.9.102-1.git.0.6411f52.el7 |
| redhat/atomic-enterprise-service-catalog | <1:4.1.16-201909090609.git.1.cc4acc1.el7 | 1:4.1.16-201909090609.git.1.cc4acc1.el7 |
| redhat/jenkins | <2-plugins-0:4.1.1567784275-1.el7 | 2-plugins-0:4.1.1567784275-1.el7 |
| redhat/openshift | <0:4.1.16-201909090609.git.0.2f97059.el8 | 0:4.1.16-201909090609.git.0.2f97059.el8 |
| redhat/openshift-ansible | <0:4.1.16-201909090609.git.162.a0800db.el7 | 0:4.1.16-201909090609.git.162.a0800db.el7 |
| Kubernetes Kubernetes | >=1.0.0<=1.12.10 | |
| Kubernetes Kubernetes | >=1.13.0<1.13.9 | |
| Kubernetes Kubernetes | >=1.14.0<1.14.5 | |
| Kubernetes Kubernetes | >=1.15.0<1.15.2 | |
| Kubernetes Kubernetes | =1.12.11-beta0 | |
| Redhat Openshift Container Platform | =3.9 | |
| Redhat Openshift Container Platform | =3.10 | |
| Redhat Openshift Container Platform | =3.11 | |
| Redhat Openshift Container Platform | =4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHBA-2019:2794
- https://access.redhat.com/errata/RHBA-2019:2816
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:3239
- https://access.redhat.com/errata/RHSA-2019:3811
- https://github.com/kubernetes/kubernetes/issues/80984
- https://groups.google.com/d/msg/kubernetes-security-announce/vUtEcSEY6SM/v2ZZxsmtFQAJ
- https://security.netapp.com/advisory/ntap-20190919-0003/
- https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1737652
- https://access.redhat.com/security/cve/cve-2019-11249
- https://bugzilla.redhat.com/show_bug.cgi?id=1737651
- https://www.cve.org/CVERecord?id=CVE-2019-11249 https://nvd.nist.gov/vuln/detail/CVE-2019-11249 https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2019-11249?
CVE-2019-11249 is a vulnerability that allows an attacker to copy malicious files from a container to the user's machine using the kubectl cp command.
What is the severity of CVE-2019-11249?
CVE-2019-11249 has a severity level of medium.
How does CVE-2019-11249 affect Kubernetes?
CVE-2019-11249 affects Kubernetes by allowing an attacker to execute a malicious tar binary inside a container during the file copying process.
Which versions of Kubernetes are affected by CVE-2019-11249?
Kubernetes versions 1.13.9, 1.14.5, 1.15.2, and 1.16.0 are affected by CVE-2019-11249.
How can I fix CVE-2019-11249?
To fix CVE-2019-11249, upgrade Kubernetes to version 1.13.9, 1.14.5, 1.15.2, or 1.16.0.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11249
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/description
- agent/event
- package-manager/redhat
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.0.0
- version/kubernetes kubernetes/1.12.10
- version/kubernetes kubernetes/1.13.0
- version/kubernetes kubernetes/1.14.0
- version/kubernetes kubernetes/1.15.0
- version/kubernetes kubernetes/1.12.11-beta0
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.9
- version/redhat openshift container platform/3.10
- version/redhat openshift container platform/3.11
- version/redhat openshift container platform/4.1