PT-2018-9619 · Kubernetes · Kubernetes

Michael Hanselmann · CVE-2018-1002100 · Publicado 2018-06-01 · Atualizado 2025-08-08

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.5.x through 1.9.5

Description: The issue concerns the insecure handling of tar data by the kubectl cp command, which can lead to the overwrite of arbitrary local files. This is a result of how the command manages data returned from the container.

Recommendations: For versions 1.5.x through 1.9.5, consider updating to a version that includes the fix for this issue, specifically version 1.9.6 or later, to prevent the insecure handling of tar data and potential overwrite of local files. As a temporary workaround, restrict the use of the kubectl cp command until a patch is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1002100

GHSA-2JQ6-FFPH-P4H8

GO-2023-1959

OPENSUSE-SU-2025:15424-1

Produtos afetados

Kubernetes

Referências · 60

• https://github.com/kubernetes/kubernetes · Nota
• https://github.com/kubernetes/kubernetes/issues/61297 · Nota
• https://github.com/kubernetes/kubernetes/commit/f180c969ccd47b9d00dbaf5cbd5b37eb8b49ae08 · Nota
• https://suse.com/security/cve/CVE-2021-30465 · Nota
• https://suse.com/security/cve/CVE-2019-11251 · Nota
• https://osv.dev/vulnerability/CVE-2018-1002100 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-27561 · Nota
• https://ubuntu.com/security/CVE-2018-1002100 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-8566 · Nota
• https://suse.com/security/cve/CVE-2015-7561 · Nota
• https://suse.com/security/cve/CVE-2020-26240 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1002100 · Nota de Segurança
• https://suse.com/security/cve/CVE-2021-25741 · Nota
• https://suse.com/security/cve/CVE-2018-19184 · Nota
• https://suse.com/security/cve/CVE-2020-8551 · Nota