Description
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.8.0 – < v1.8*, v1.9.0 – < v1.9*, v1.10.0 – < v1.10*, v1.11.0 – < v1.11*, v1.12.0 – < v1.12*, v1.13.0 – < v1.13*, v1.14.0 – < v1.14* | v1.8* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | openshift +3 | 4.1.24-201911080309.git.0.c41acf2.el7 | RHSA-2019:3942 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.161-1.git.0.4ccbe25.el7 | RHSA-2020:0020 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kubeadm +2 | 1.12.7-1.2.3.el7 | ELSA-2019-4816, ELSA-2019-4716 |
| Oracle Linux 7 | kubeadm-ha-setup | 0.0.2-1.0.52.el7 | ELSA-2019-4816, ELSA-2019-4717 |
| Oracle Linux 7 | kubeadm-upgrade | 0.0.1-1.0.27.el7 | ELSA-2019-4816 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/client-go | >= 1.8.0, < 1.12.9 | 1.12.9 | GHSA-2575-pghm-6qqx |
Advisories 5
- RHSA-2020:0020 Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:3942 Red Hat Security Advisory: OpenShift Container Platform 4.1.24 openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2019-4816 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 31, 2020
- ELSA-2019-4717 Important: kubeadm-ha-setup security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 29, 2019
- ELSA-2019-4716 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 29, 2019
References
- https://github.com/kubernetes/kubernetes/issues/76676
- 108064 vdb-entry
- https://security.netapp.com/advisory/ntap-20190509-0002/
- RHSA-2019:3942 vendor-advisory
- RHSA-2020:0020 vendor-advisory
- RHSA-2020:0074 vendor-advisory