Description
A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | kubernetes-client/java | 10.0.0 – < 25.0.1, 26.0.0 | 25.0.1 |
References
- https://github.com/kubernetes-client/java/issues/4861 issue-tracking