In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
https://hansmi.ch/articles/2018-04-openshift-s2i-security
https://github.com/kubernetes/kubernetes/issues/61297
https://bugzilla.redhat.com/show_bug.cgi?id=1564305
Source: Mitre, NVD
Published: 2018-06-02
Updated: 2024-11-21
Base Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P
Severity: Low
Base Score: 5.5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity: Medium
EPSS: 0.0058