The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.

A third issue was discovered with the Kubernetes kubectl cp command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires user interaction to be exploited.

This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the kubectl cp operation. The vulnerability is a client-side defect and requires user interaction to be exploited.

Upstream Issue:

https://github.com/kubernetes/kubernetes/issues/80984

External References:

https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.

The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.

A out of bound write can occur when patching a Openshift object using the 'oc patch' functionality in OpenShift Container Platform 3.6 and earlier. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.

OpenShift Container Platform and OpenShift Online have a flaw in the source-to-image functionality. An attacker that can create images with the 'io.openshift.s2i.assemble-user' LABEL set to 'root' can execute arbitrary code with full privileges in the builder pod during S2I build.

A reflected XSS vulnerability exists in authentication flow of OpenShift Container Platform. An attacker could use this flaw to steal authentication data by getting them to click on a malicious link.

A remote code execution vulnerability exists in Xterm.js before versions 3.8.1, 3.9.2 and 3.10.1 when the component mishandles special characters.

Upstream Releases:

https://github.com/xtermjs/xterm.js/releases/tag/3.8.1 https://github.com/xtermjs/xterm.js/releases/tag/3.9.2 https://github.com/xtermjs/xterm.js/releases/tag/3.10.1