CVE-2020-8570

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.

Score

CVSS 3.1 9.1 Critical

Status

Modified - jordan@liggitt.net

Published

2021-01-21

Last modified

2024-09-16

Weaknesses

CWE-22, CWE-23

Affected products

• Java (Kubernetes)
• Kubernetes Java Client (Kubernetes)

References

• https://github.com/kubernetes-client/java/issues/1491
• https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrg
• https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apach…
• https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apach…
• https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apach…
• https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apach…