https://github.com/kubernetes/kubernetes/pull/76788

https://groups.google.com/forum/#%21topic/kubernetes-security-announce/NLs2TGbfPdo

https://security.netapp.com/advisory/ntap-20190919-0003/

Kubernetes https://groups.google.com/forum/#%21topic/kubernetes-security-announce/NLs2TGbfPdo [No types assigned]

Kubernetes https://groups.google.com/forum/#!topic/kubernetes-security-announce/NLs2TGbfPdo

NIST AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NIST AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NIST CWE-22

NIST CWE-264

https://security.netapp.com/advisory/ntap-20190919-0003/ No Types Assigned

https://security.netapp.com/advisory/ntap-20190919-0003/ Third Party Advisory

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system 

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system 

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system 

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system 

https://security.netapp.com/advisory/ntap-20190919-0003/ [No Types Assigned]

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

CWE-264

OR
     *cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* versions from (including) 1.0.0 up to (including) 1.12.10
     *cpe:2.3:a:kubernetes:kubernetes:1.12.11:beta0:*:*:*:*:*:*
     *cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* versions from (including) 1.13.0 up to (excluding) 1.13.9
     *cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* versions from (including) 1.14.0 up to (excluding) 1.14.5
     *cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* versions from (including) 1.15.0 up to (exc

https://github.com/kubernetes/kubernetes/pull/76788 No Types Assigned

https://github.com/kubernetes/kubernetes/pull/76788 Patch, Third Party Advisory

https://groups.google.com/forum/#!topic/kubernetes-security-announce/NLs2TGbfPdo No Types Assigned

https://groups.google.com/forum/#!topic/kubernetes-security-announce/NLs2TGbfPdo Third Party Advisory

Victim must voluntarily interact with attack mechanism