Kubernetes up to 1.13.8/1.14.4/1.15.1 kubectl cp Command access control

Summaryinfo

A vulnerability marked as critical has been reported in Kubernetes up to 1.13.8/1.14.4/1.15.1. This affects an unknown part of the component kubectl cp Command Handler. Performing a manipulation results in access control. This vulnerability was named CVE-2019-11249. The attack needs to be approached locally. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Kubernetes up to 1.13.8/1.14.4/1.15.1 (Virtualization Software). This affects an unknown code of the component kubectl cp Command Handler. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

The weakness was presented 08/29/2019 (Website). The advisory is shared at groups.google.com. This vulnerability is uniquely identified as CVE-2019-11249 since 04/17/2019. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 1.13.9, 1.14.5 or 1.15.2 eliminates this vulnerability.

See VDB-141031 for similar entry. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Kubernetes

Version

• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4
• 1.13.5
• 1.13.6
• 1.13.7
• 1.13.8
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.15.0
• 1.15.1

License

• open-source

Website

• Product: https://github.com/kubernetes/kubernetes/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion