Description
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.5.x, v1.6.x, v1.7.x, v1.8.x, unspecified – < v1.9.6 | v1.9.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.17.4-1 | — |
| Debian 13 | kubernetes | 1.17.4-1 | — |
| Debian 12 | kubernetes | 1.17.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +13 | 3.9.30-1.git.0.dec1ba7.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | atomic-openshift-dockerregistry | 3.9.30-1.git.349.8b7912c.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.9.30-1.git.245.4a3aade.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | cri-o | 1.9.12-1.gitfa11beb.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | cri-tools | 1.0.0-5.rhaos3.9.git8e6013a.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.9.30-1.git.7.46f8678.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | prometheus-node-exporter +1 | 3.9.30-1.git.890.7ea5173.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-elasticsearch +1 | 1.16.1-1.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-kubernetes_metadata_filter +1 | 1.0.3-1.el7 | RHBA-2018:1796 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.5.0-alpha.0, < 1.9.6 | 1.9.6 | GHSA-2jq6-ffph-p4h8 |
| Go | k8s.io/kubernetes | >= 1.5.0, < 1.9.6 | 1.9.6 | GO-2023-1959 |
Advisories 2
- RHBA-2018:1796 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.9 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026