CVE-2018-1002100

CVSS 4.2 MEDIUMEPSS 1.6%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.2EPSS 1.6%KEV nãoPoC —Patch —

Lifecycle

Jun 01, 2018Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Affected products

Kubernetes · Kubernetes

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bugzilla.redhat.com/show_bug.cgi?id=1564305 https://github.com/kubernetes/kubernetes/issues/61297 https://hansmi.ch/articles/2018-04-openshift-s2i-security