oss-security - [Security Advisory] CVE-2020-8570: Path Traversal bug in the Java Kubernetes Client

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID:
 <MW4PR21MB18574AC1AC607174551A3519DBAB9@MW4PR21MB1857.namprd21.prod.outlook.com>
Date: Mon, 11 Jan 2021 23:15:54 +0000
From: Brendan Burns <bburns@...rosoft.com>
To: kubernetes-announce <kubernetes-announce@...glegroups.com>, Kubernetes
 developer/contributor discussion <kubernetes-dev@...glegroups.com>,
	"kubernetes-security-announce@...glegroups.com"
	<kubernetes-security-announce@...glegroups.com>,
	"kubernetes-security-discuss@...glegroups.com"
	<kubernetes-security-discuss@...glegroups.com>,
	"distributors-announce@...ernetes.io" <distributors-announce@...ernetes.io>,
	"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
	"kubernetes+announcements@...coursemail.com"
	<kubernetes+announcements@...coursemail.com>
CC: Min Kim <yue9944882@...il.com>
Subject: [Security Advisory] CVE-2020-8570: Path Traversal bug in the Java
 Kubernetes Client

Hello Kubernetes Community,

A security issue was discovered in Kubernetes Java Client that could overwrite files outside of the current directory when copying files from a Pod.

This issue has assigned CVE-2020-8570.

<https://github.com/kubernetes/security/blob/master/comms-templates/vulnerability-announcement-email.md#am-i-vulnerable>Am I vulnerable?

If you are not using the Java client for Kubernetes, you are not impacted.

If you are not using Copy in the Java client for Kubernetes, you are not impacted.

If you are using Copy and you have upgraded to 9.0.2, 10.0.1 or 11.0.0 you are not impacted.

Otherwise, if you are using Copy with an older version of the Java client and you are copying from untrusted Pods you may be impacted.

<https://github.com/kubernetes/security/blob/master/comms-templates/vulnerability-announcement-email.md#affected-versions>Affected Versions

  *   All versions prior to 9.0.2
  *   Version 10.0.0

<https://github.com/kubernetes/security/blob/master/comms-templates/vulnerability-announcement-email.md#how-do-i-mitigate-this-vulnerability>How do I mitigate this vulnerability?

ACTION REQUIRED: Upgrade to 9.0.2, 10.0.1 or 11.0.0

Prior to upgrading, this vulnerability can be mitigated by not Copying files from untrusted Pods

<https://github.com/kubernetes/security/blob/master/comms-templates/vulnerability-announcement-email.md#fixed-versions>Fixed Versions

  *   9.0.2
  *   10.0.1
  *   11.0.0

Detection

If you find evidence that this vulnerability has been exploited, please contact security@...ernetes.io<mailto:security@...ernetes.io>

<https://github.com/kubernetes/security/blob/master/comms-templates/vulnerability-announcement-email.md#additional-details>Additional Details

See the GitHub issue for more details: https://github.com/kubernetes-client/java/issues/1491

<https://github.com/kubernetes/security/blob/master/comms-templates/vulnerability-announcement-email.md#acknowledgements>Acknowledgements

This vulnerability was reported by CodeQL Automated scanning by GitHub

Thank You,

Brendan Burns on behalf of the Kubernetes Product Security Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.