CVE-2019-11251
Fixed in a distro release EPSS 3%CVSS 4.8
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.13.11 |
| Go | k8s.io/kubernetes | 1.14.7 |
| Go | k8s.io/kubernetes | 1.16.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.154-1.git.0.7a097ad.el7 |
| Red Hat:openshift:3.9 | atomic-openshift | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-clients | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-clients-redistributable | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-cluster-capacity | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-docker-excluder | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-excluder | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-federation-services | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-master | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-node | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-pod | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-sdn-ovs | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-service-catalog | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-template-service-broker | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:3.9 | atomic-openshift-tests | 0:3.9.102-1.git.0.6411f52.el7 |
| Red Hat:openshift:4.1 | openshift | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
| Red Hat:openshift:4.1 | openshift | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
| Red Hat:openshift:4.1 | openshift-clients | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
| Red Hat:openshift:4.1 | openshift-clients | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
| Red Hat:openshift:4.1 | openshift-clients-redistributable | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
| Red Hat:openshift:4.1 | openshift-clients-redistributable | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
| Red Hat:openshift:4.1 | openshift-hyperkube | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
| Red Hat:openshift:4.1 | openshift-hyperkube | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |