| { |
| "schema_version": "1.4.0", |
| "id": "GHSA-6qfg-8799-r575", |
| "modified": "2021-05-17T21:58:06Z", |
| "published": "2021-05-18T15:30:07Z", |
| "aliases": [ |
| "CVE-2019-11251" |
| ], |
| "summary": "Symlink Attack", |
| "details": "The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.", |
| "affected": [ |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/kubernetes/kubernetes/pkg/kubectl/cmd/cp" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "1.13.10" |
| }, |
| { |
| "fixed": "1.13.11" |
| } |
| ] |
| } |
| ] |
| }, |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/kubernetes/kubernetes/pkg/kubectl/cmd/cp" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "1.14.6" |
| }, |
| { |
| "fixed": "1.14.7" |
| } |
| ] |
| } |
| ] |
| }, |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/kubernetes/kubernetes/pkg/kubectl/cmd/cp" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "1.15.3" |
| }, |
| { |
| "fixed": "1.16.0" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "severity": [ |
| { |
| "type": "CVSS_V3", |
| "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N" |
| } |
| ], |
| "references": [ |
| { |
| "type": "ADVISORY", |
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11251" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/kubernetes/kubernetes/issues/87773" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/kubernetes/kubernetes/pull/82143" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://groups.google.com/d/msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ" |
| } |
| ], |
| "database_specific": { |
| "cwe_ids": [ |
| "CWE-59", |
| "CWE-61" |
| ], |
| "github_reviewed": true, |
| "github_reviewed_at": "2021-05-17T21:58:06Z", |
| "nvd_published_at": null, |
| "severity": "MODERATE" |
| } |
| } |
