Description
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | prior to 1.13.11, prior to 1.14.7, prior to 1.15.4, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | openshift +3 | 4.1.21-201910220952.git.0.493dbf6.el7 | RHSA-2019:3266 |
| Red Hat OpenShift 3 | atomic-openshift +13 | 3.9.102-1.git.0.6411f52.el7 | RHSA-2019:3905, RHSA-2019:3811 |
| Red Hat OpenShift 3 | atomic-openshift-hyperkube +1 | 3.11.154-1.git.0.7a097ad.el7 | RHSA-2019:3905 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kubeadm +2 | 1.12.10-1.0.10.el7 | ELSA-2019-4816 |
| Oracle Linux 7 | kubeadm-ha-setup | 0.0.2-1.0.68.el7 | ELSA-2019-4816 |
| Oracle Linux 7 | kubeadm-upgrade | 0.0.1-1.0.27.el7 | ELSA-2019-4816 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.13.10, < 1.13.11 | 1.13.11 | GHSA-6qfg-8799-r575 |
| Go | k8s.io/kubernetes | >= 1.14.6, < 1.14.7 | 1.14.7 | GHSA-6qfg-8799-r575 |
| Go | k8s.io/kubernetes | >= 1.15.3, < 1.16.0 | 1.16.0 | GHSA-6qfg-8799-r575 |
| Go | k8s.io/kubernetes | >= 1.13.10, < 1.13.11 · >= 1.14.6, < 1.14.7 · >= 1.15.3, < 1.16.0 | 1.13.11, 1.14.7, 1.16.0 | GO-2022-0802 |
Advisories 6
- RHSA-2019:3905 Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3811 Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RHSA-2019:3266 Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- ELSA-2019-4816 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 31, 2020