Go/k8s.io/kubernetes CVE-2019-1002101: medium 5.5, EPSS 12.80%
Symlink Attack in kubectl cp
Action: Upgrade k8s.io/kubernetes to 1.11.9 or later.
go get k8s.io/kubernetes@v1.11.9go get k8s.io/kubernetes@v1.12.7go get k8s.io/kubernetes@v1.13.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.9 | - |
| 1.12.0 | 1.12.7 | - |
| 1.13.0 | 1.13.5 | - |
Fixed versions
| 1.11.9 | 1.12.7 | 1.13.5 |
Sources
- osv: GHSA-34jx-wx69-9x8v
- https://nvd.nist.gov/vuln/detail/CVE-2019-1002101
- https://github.com/kubernetes/kubernetes/pull/75037
- https://github.com/kubernetes/kubernetes/commit/47063891dd782835170f500a83f37cc98c3c1013
- https://access.redhat.com/errata/RHBA-2019:0619
- https://access.redhat.com/errata/RHBA-2019:0620
- https://access.redhat.com/errata/RHBA-2019:0636
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPV2RE5RMOGUVP5WJMXKQJZUBBLAFZPZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QZB7E3DOZ5WDG46XAIU6K32CXHXPXB2F
- https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101
- http://www.openwall.com/lists/oss-security/2019/06/21/1
- http://www.openwall.com/lists/oss-security/2019/08/05/5
- http://www.securityfocus.com/bid/107652
CVE-2019-1002101 · published · modified · JSON