CVE-2019-11251: kubectl cp allows symlink directory traversal
A vulnerability has been discovered in kubectl cp that allows a combination of two symlinks to copy a file outside of its destination directory. This could be used to allow an attacker to place a netfarious file using a symlink, outside of the destination tree.
Reference: https://github.com/kubernetes/kubernetes/pull/82143 https://github.com/kubernetes/kubernetes/pull/82143 https://github.com/kubernetes/kubernetes/pull/82384 https://github.com/kubernetes/kubernetes/pull/82502 https://github.com/kubernetes/kubernetes/pull/82503
Other sources
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-11251.
What is the severity of CVE-2019-11251?
The severity of CVE-2019-11251 is medium with a severity value of 5.7.
Which versions of Kubernetes are affected by CVE-2019-11251?
Versions 1.1-1.12 and versions prior to 1.13.11, 1.14.7, and 1.15.4 of Kubernetes are affected by CVE-2019-11251.
How can the CVE-2019-11251 vulnerability be fixed?
To fix the CVE-2019-11251 vulnerability, update Kubernetes to version 1.16.0 or above, or to versions 1.13.11, 1.14.7, or 1.15.4.
Where can I find more information about CVE-2019-11251?
You can find more information about CVE-2019-11251 at the following references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2019-11251), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-11251), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1753495), and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:3905).