CVE-2020-8570 Kubernetes Java client libraries unvalidated path traversal in Copy implementation
CriticalCVSS 9.1
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| io.kubernetes/client-java(Maven) | < 9.0.2 | 9.0.2 |
| io.kubernetes/client-java(Maven) | = 10.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 0.1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 0.2 | No fix listed |
| io.kubernetes/client-java(Maven) | = 1.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 1.0.0-beta1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 1.0.0-beta2 | No fix listed |
| io.kubernetes/client-java(Maven) | = 1.0.0-beta3 | No fix listed |
| io.kubernetes/client-java(Maven) | = 1.0.0-beta4 | No fix listed |
| io.kubernetes/client-java(Maven) | = 2.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 2.0.0-beta1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 2.0.0-beta2 | No fix listed |
| io.kubernetes/client-java(Maven) | = 3.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 3.0.0-beta1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 3.0.0-beta2 | No fix listed |
| io.kubernetes/client-java(Maven) | = 4.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 4.0.0-beta1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 5.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 6.0.1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 7.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 8.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 8.0.0-alpha1 | No fix listed |
| io.kubernetes/client-java(Maven) | = 8.0.2 | No fix listed |
| io.kubernetes/client-java(Maven) | = 9.0.0 | No fix listed |
| io.kubernetes/client-java(Maven) | = 9.0.1 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| io.kubernetes/client-java(Maven) | >= 10.0.0, < 10.0.1 | 10.0.1 |
| kubernetes java | < 9.0.2 | 9.0.2 |
| kubernetes java | >= 10.0.0, < 10.0.1 | 10.0.1 |
| Kubernetes Java Client | = all versions prior to 9.0 | No fix listed |
| Kubernetes Java Client | >= 9.0, < 9.0.2 | 9.0.2 |
| Kubernetes Java Client | >= 10.0, < 10.0.1 | 10.0.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com patch
- groups.google.com mailing-list third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- github.com
- github.com product
- [druid-commits] 20210202 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- [druid-commits] 20210203 [GitHub] [druid] jihoonson merged pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- [druid-commits] 20210201 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- [druid-commits] 20210203 [GitHub] [druid] jihoonson commented on pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list