Vulnerability Details CVE-2019-11251
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.02
EPSS Ranking 82.9%
CVSS Severity
CVSS v3 Score 4.8
CVSS v2 Score 4.3
References
Products affected by CVE-2019-11251
-
cpe:2.3:a:kubernetes:kubernetes:1.1-1.12
-
cpe:2.3:a:kubernetes:kubernetes:1.13.0
-
cpe:2.3:a:kubernetes:kubernetes:1.13.1
-
cpe:2.3:a:kubernetes:kubernetes:1.13.10
-
cpe:2.3:a:kubernetes:kubernetes:1.13.2
-
cpe:2.3:a:kubernetes:kubernetes:1.13.3
-
cpe:2.3:a:kubernetes:kubernetes:1.13.4
-
cpe:2.3:a:kubernetes:kubernetes:1.13.5
-
cpe:2.3:a:kubernetes:kubernetes:1.13.6
-
cpe:2.3:a:kubernetes:kubernetes:1.13.7
-
cpe:2.3:a:kubernetes:kubernetes:1.13.8
-
cpe:2.3:a:kubernetes:kubernetes:1.13.9
-
cpe:2.3:a:kubernetes:kubernetes:1.14.0
-
cpe:2.3:a:kubernetes:kubernetes:1.14.1
-
cpe:2.3:a:kubernetes:kubernetes:1.14.2
-
cpe:2.3:a:kubernetes:kubernetes:1.14.3
-
cpe:2.3:a:kubernetes:kubernetes:1.14.4
-
cpe:2.3:a:kubernetes:kubernetes:1.14.5
-
cpe:2.3:a:kubernetes:kubernetes:1.14.6
-
cpe:2.3:a:kubernetes:kubernetes:1.15.0
-
cpe:2.3:a:kubernetes:kubernetes:1.15.1
-
cpe:2.3:a:kubernetes:kubernetes:1.15.2
-
cpe:2.3:a:kubernetes:kubernetes:1.15.3