Cloud Foundry Logo
blog single gear
Security Advisory

CVE-2019-1002101: Kubernetes kubectl – potential directory traversal

CVE-2019-1002101: Kubernetes kubectl – potential directory traversal

Severity

High

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

  • Cloud Foundry Container Runtime (CFCR)
    • All versions prior to 0.31.0

Description

A security issue was discovered with the Kubernetes `kubectl cp` command that could enable a directory traversal replacing or deleting files on a users workstation. The issue is High severity and upgrading kubectl to Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0 is encouraged to fix this issue.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

  • Releases that have fixed this issue include:
    • CFCR version 0.31.0

History

2019-04-01: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES