The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Kubernetes | — | Upgrade Kubernetes to version 1.14.7Upgrade Kubernetes to version 1.13.11Upgrade Kubernetes to version 1.15.4 | Feb 14, 2020 | Feb 3, 2020 |
| Oracle_linux | — | Upgrade kubectlUpgrade kubeadmUpgrade kubeadm-upgradeUpgrade kubeadm-ha-setupUpgrade kubeletUpgrade kubernetes | Oct 10, 2019 | Oct 9, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshiftUpgrade openshift | Oct 31, 2019 | Sep 18, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 3, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub