CVE-2019-11251 — UNIX Symbolic Link (Symlink) Following in Kubernetes

CWE-61 — UNIX Symbolic Link (Symlink) FollowingCWE-59 — Link Following11 documents7 sources
Severity
5.7MEDIUMNVD
CNA4.8
EPSS
3.4%
top 12.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
K8s.io KubernetesKubernetes
Timeline
PublishedFeb 3
Latest updateAug 21

Description

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages3 packages

▶Gok8s.io/kubernetes1.13.10 — 1.13.11+2
▶NVDkubernetes/kubernetes1.13.0 — 1.13.11+3
▶CVEListV5kubernetes/kubernetes15 versions+14

🔴Vulnerability Details

5
OSV
Kubernetes kubectl cp Vulnerable to Symlink Attack in k8s.io/kubernetes↗2024-08-21
▶
GHSA
Kubernetes kubectl cp Vulnerable to Symlink Attack↗2021-05-18
▶
OSV
Kubernetes kubectl cp Vulnerable to Symlink Attack↗2021-05-18
▶
OSV
CVE-2019-11251: The Kubernetes kubectl cp command in versions 1↗2020-02-03
▶
CVEList
kubectl cp allows symlink directory traversal↗2020-02-03
▶

📋Vendor Advisories

2
Red Hat
kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks↗2019-09-18
▶
Debian
CVE-2019-11251: kubernetes - The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1....↗2019
▶

💬Community

3
Bugzilla
CVE-2019-11251 kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks [fedora-all]↗2019-09-19
▶
Bugzilla
CVE-2019-11251 kubernetes:1.10/kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks [fedora-all]↗2019-09-19
▶
Bugzilla
CVE-2019-11251 kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks↗2019-09-19
▶
CVE-2019-11251 — UNIX Symbolic Link (Symlink) Following | cvebase