Vulnerability Description
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Java | < 9.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/kubernetes-client/java/issues/1491Issue TrackingPatchThird Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrgMailing ListThird Party Advisory
- https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540
- https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25
- https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8
- https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc
- https://github.com/kubernetes-client/java/issues/1491Issue TrackingPatchThird Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrgMailing ListThird Party Advisory
- https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540
- https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25
- https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8
- https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc
FAQ
What is CVE-2020-8570?
CVE-2020-8570 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a malici...
How severe is CVE-2020-8570?
CVE-2020-8570 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-8570?
Check the references section above for vendor advisories and patch information. Affected products include: Kubernetes Java.