GHSA-2jq6-ffph-p4h8
Kubernetes arbitrary file overwrite
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.5.0-alpha.0, < 1.9.6 | 1.9.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
References
External links from the advisory. They lead to third-party sites.