Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Kubernetes kubectl cp command allows file copying with malicious results

CVE-2019-1002101 · published 7 years ago
Summary

The kubectl cp command can be exploited to write malicious files to a user's machine if the container being accessed contains a corrupted tar binary. This can happen if the container's tar binary is malicious. Affected users should update to a fixed version of kubectl, such as v1.11.9 or later, to mitigate this risk.

What to do
  • Update k8s.io kubernetes to version 1.11.9.
  • Update k8s.io kubernetes to version 1.12.7.
  • Update k8s.io kubernetes to version 1.13.5.
Affected software
Ecosystem VendorProductAffected versions
go k8s.io kubernetes < 1.11.9
>= 1.12.0, < 1.12.7
>= 1.13.0, < 1.13.5
Fix: upgrade to 1.11.9
– kubernetes kubernetes >= 1.11.0, < 1.11.9
>= 1.12.0, < 1.12.7
>= 1.13.0, < 1.13.5
1.14.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
– redhat openshift_container_platform 3.9
3.10
3.11
cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*
Original advisory text
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and k...
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
13% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published1 Apr 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-34jx-wx69-9x8v · GHSA
CVE-2019-1002101 · NVD
Track software like this
Free during beta