A third issue was discovered with the Kubernetes `kubectl cp` command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires user interaction to be exploited. This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the `kubectl cp` operation. The vulnerability is a client-side defect and requires user interaction to be exploited. Upstream Issue: https://github.com/kubernetes/kubernetes/issues/80984 External References: https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc
Created kubernetes tracking bugs for this issue: Affects: fedora-all [bug 1737652]
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.10 Via RHSA-2019:3239 https://access.redhat.com/errata/RHSA-2019:3239
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11249
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.9 Via RHSA-2019:3811 https://access.redhat.com/errata/RHSA-2019:3811