CVSS 3.0
5.5 mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2018-1002100
Medium (5.5) in kubernetes kubernetes. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in k8s.io/kubernetes 1.9.6.
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kubernetes:kubernetes
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2jq6-ffph-p4h8 | Go | k8s.io/kubernetes | >=1.5.0-alpha.0 <1.9.6 | 1.9.6 |
| GO-2023-1959 | Go | k8s.io/kubernetes | >=1.5.0 <1.9.6 | 1.9.6 |