Database/Container, Kubernetes & orchestration
Kubernetes (kubectl): Follow-up incomplete fix for the kubectl cp traversal
CVSS 6.5CVE-2019-11249Container, Kubernetes & orchestrationcurated
Impact
Follow-up incomplete fix for the kubectl cp traversal
Who can reach it
Malicious image
What to do
Upgrade kubectl on operator and CI machines
References
Related entries
- Kubernetes (kubectl): Double-symlink in tar output escapes the kubectl cp destinationCVE-2019-11251 · Kubernetes (kubectl)Medium
- Kubernetes (kubectl): kubectl does not neutralise ANSI escape sequences in outputCVE-2021-25743 · Kubernetes (kubectl)Low
- Kubernetes (kubectl): `kubectl cp` path traversal from a malicious container tar overwrites files on the operator'sCVE-2019-11246 · Kubernetes (kubectl)Medium
- Kubernetes (client-go): Bearer tokens logged at verbosity 7+CVE-2019-11250 · Kubernetes (client-go)Medium
- Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserverCVE-2019-11254 · Kubernetes (kube-apiserver)Medium
- Harbor: Non-admin users create admin accounts via POST /api/usersCVE-2019-16097 · HarborMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.