CVE-2019-11249 is a kubectl cp vulnerability that may let malicious attackers use directory traversal to write or replace files from a container TAR archive outside the destination path on the host, limited only by the local user's system permissions.
Background
The kubectl cp command copies files between containers and hosts. To copy from a container, Kubernetes runs the tar command to create a TAR package, sends it to the host, and decompresses it.
If a container TAR archive contains malicious files, an attacker with kubectl cp permissions can exploit directory traversal to write files outside the destination path.
The fix enforces strict destination path validation during TAR package decompression, blocking files that target paths outside the specified destination.
See the CVE-2019-11249 pull requests for fix details.
Potential impacts
Run kubectl version --client to check your kubectl version.
Affected kubectl versions:
- kubectl 1.0.x-1.12.x
- kubectl 1.13.0 to 1.13.8 (fixed in v1.13.9)
- kubectl 1.14.0 to 1.14.4 (fixed in v1.14.5)
- kubectl 1.15.0 to 1.15.1 (fixed in v1.15.2)
Fixes
Install a fixed kubectl version, then verify the version.
- For kubectl 1.13.x, upgrade to 1.13.9.
- For kubectl 1.14.x, upgrade to 1.14.5.
- For kubectl 1.15.x, upgrade to 1.15.2.
- For kubectl 1.12.x or earlier, upgrade to 1.13.9, 1.14.5, or 1.15.2.