{"id":"CVE-2018-1002100","aliases":["DEBIAN-CVE-2018-1002100","EUVD-2022-2004","GHSA-2jq6-ffph-p4h8","GO-2023-1959","RHBA-2018:1796","UBUNTU-CVE-2018-1002100","openSUSE-SU-2025:15424-1"],"status":"published","title":"Kubernetes arbitrary file overwrite","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","severity":{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01642,"percentile":0.76717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-06-01T21:00:00Z","modified":"2026-10-24T10:50:31Z","fixes":[{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.9.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0-alpha.0"},{"fixed":"1.9.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0-alpha.0"},{"fixed":"1.9.6"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.349.8b7912c.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-federation-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.0.dec1ba7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.7.46f8678.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.245.4a3aade.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.12-1.gitfa11beb.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.12-1.gitfa11beb.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.rhaos3.9.git8e6013a.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.rhaos3.9.git8e6013a.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.890.7ea5173.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.7.46f8678.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"openshift-ansible-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.7.46f8678.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"openshift-ansible-playbooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.7.46f8678.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"openshift-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.7.46f8678.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.30-1.git.890.7ea5173.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"rubygem-fluent-plugin-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"rubygem-fluent-plugin-elasticsearch-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"rubygem-fluent-plugin-kubernetes_metadata_filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"rubygem-fluent-plugin-kubernetes_metadata_filter-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250807T150727-1.1"}]}],"bundled":44}],"products":[{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/61297","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://hansmi.ch/articles/2018-04-openshift-s2i-security","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564305","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1002100","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2jq6-ffph-p4h8","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1002100","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://access.redhat.com/errata/RHBA-2018:1796","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1550847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1554407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1557290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559443","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1567250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1567767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1568361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1569825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1570540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1570982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1577357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1577359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1577877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1582190","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhba-2018_1796.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000400","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1002100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1002100","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2018-1002100","tags":["report"]},{"url":"https://github.com/kubernetes/kubernetes/commit/f180c969ccd47b9d00dbaf5cbd5b37eb8b49ae08","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1002102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47908","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1002100","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2018-06-01T21:00:00Z","modified":"2024-09-16T16:17:37.665Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2022-2004","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2018-06-01T21:00:00Z","modified":"2024-09-16T16:17:37Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:53.554412Z"}],"ghsa":[{"id":"GHSA-2jq6-ffph-p4h8","title":"Kubernetes arbitrary file overwrite","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2022-05-13T01:35:04Z","modified":"2026-01-16T21:46:45Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:18.564331Z"}],"nvd":[{"id":"CVE-2018-1002100","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2018-06-02T01:29:02.11Z","modified":"2026-06-17T01:33:19.993Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:28.483469Z"}],"osv":[{"id":"CVE-2018-1002100","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2018-06-02T01:29:02.11Z","modified":"2026-10-24T10:50:31.066464177Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1002100","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2018-06-02T01:29:02.11Z","modified":"2026-10-23T18:03:22.894315834Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"GHSA-2jq6-ffph-p4h8","title":"Kubernetes arbitrary file overwrite","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"published","published":"2022-05-13T01:35:04Z","modified":"2026-02-03T03:16:59.386576Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"RHBA-2018:1796","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 3.9 bug fix and enhancement update","status":"published","published":"2024-09-16T01:13:29Z","modified":"2026-07-01T10:03:14Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2018-1002100","description":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","status":"withdrawn","published":"2018-06-02T01:29:00Z","modified":"2025-07-14T06:33:57.214532Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"GO-2023-1959","title":"Kubernetes arbitrary file overwrite in k8s.io/kubernetes","description":"Kubernetes arbitrary file overwrite in k8s.io/kubernetes","status":"published","published":"2024-08-20T20:32:20Z","modified":"2026-03-03T04:54:02.509081Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2025:15424-1","title":"govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-08T00:00:00Z","modified":"2026-03-23T04:53:45.821911Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}