CVE-2019-1002101: Kubernetes kubectl – potential directory traversal

Severity

High

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• Cloud Foundry Container Runtime (CFCR)
  • All versions prior to 0.31.0

Description

A security issue was discovered with the Kubernetes `kubectl cp` command that could enable a directory traversal replacing or deleting files on a users workstation. The issue is High severity and upgrading kubectl to Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0 is encouraged to fix this issue.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

• Releases that have fixed this issue include:
  • CFCR version 0.31.0

History

2019-04-01: Initial vulnerability report published.