CVE-2018-1002100

NameCVE-2018-1002100
DescriptionIn Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs929225

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kubernetes (PTS)bullseye1.20.5+really1.20.2-1fixed
sid, bookworm1.20.5+really1.20.2-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kubernetessource(unstable)1.17.4-1929225

Notes

https://github.com/kubernetes/kubernetes/issues/61297
https://github.com/kubernetes/kubernetes/commit/f180c969ccd47b9d00dbaf5cbd5b37eb8b49ae08 (1.9.x)

Search for package or bug name: Reporting problems