Vulnerability Name:

CVE-2019-11249 (CCN-164768)

Assigned:2019-08-05
Published:2019-08-05
Updated:2020-10-02
Summary:The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-22
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-11249

Source: REDHAT
Type: Third Party Advisory
RHBA-2019:2794

Source: REDHAT
Type: Third Party Advisory
RHBA-2019:2816

Source: REDHAT
Type: Third Party Advisory
RHBA-2019:2824

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:3239

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:3811

Source: XF
Type: UNKNOWN
kubernetes-cve201911249-dir-trav(164768)

Source: CCN
Type: Kubernetes GIT Repository
v1.13.9

Source: CCN
Type: Kubernetes GIT Repository
v1.14.5

Source: CCN
Type: Kubernetes GIT Repository
v1.15.2

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/80984

Source: MLIST
Type: Patch, Third Party Advisory
v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249

Source: CCN
Type: oss-sec Mailing List, Mon, 5 Aug 2019 12:01:22 -0400
Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20190919-0003/

Source: CCN
Type: IBM Security Bulletin 1146580 (Watson Studio Local)
Vulnerabilities in Kubernetes affects IBM Watson Studio Local

Source: CCN
Type: IBM Security Bulletin 1167154 (API Connect)
IBM API Connect is impacted by vulnerabilities in Kubernetes (CVE-2019-11249, CVE-2019-11247)

Source: CCN
Type: IBM Security Bulletin 1168522 (PowerAI Vision)
A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision

Source: CCN
Type: IBM Security Bulletin 6436613 (InfoSphere Information Server)
Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server

Source: CCN
Type: IBM Security Bulletin 6599703 (Db2 On Openshift)
Multiple vulnerabilities affect IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data

Vulnerable Configuration:Configuration 1:
  • cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.0.0 and <= 1.12.10)
  • OR cpe:/a:kubernetes:kubernetes:1.12.11:beta0:*:*:*:*:*:*
  • OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.13.0 and < 1.13.9)
  • OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.14.0 and < 1.14.5)
  • OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.15.0 and < 1.15.2)

    • Configuration 2:
  • cpe:/a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:kubernetes:kubernetes:1.13.0:-:*:*:*:*:*:*
  • OR cpe:/a:kubernetes:kubernetes:1.14.0:*:*:*:*:*:*:*
  • OR cpe:/a:kubernetes:kubernetes:1.15.0:-:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_studio_local:1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:powerai_vision:1.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:2018.4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:2018.4.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:powerai_vision:1.1.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:112523
    P
    		kubernetes-apiserver-1.22.2-21.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106014
    P
    		kubernetes-apiserver-1.22.2-21.2 on GA media (Moderate)
    2021-10-01
    oval:com.ubuntu.disco:def:2019112490000000
    V
    		CVE-2019-11249 on Ubuntu 19.04 (disco) - medium.
    2019-08-29
    BACK
    kubernetes kubernetes *
    kubernetes kubernetes 1.12.11 beta0
    kubernetes kubernetes *
    kubernetes kubernetes *
    kubernetes kubernetes *
    redhat openshift container platform 3.9
    redhat openshift container platform 3.10
    redhat openshift container platform 3.11
    redhat openshift container platform 4.1
    kubernetes kubernetes 1.13.0
    kubernetes kubernetes 1.14.0
    kubernetes kubernetes 1.15.0 -
    ibm infosphere information server 11.7
    ibm watson studio local 1.2.3
    ibm powerai vision 1.1.4
    ibm api connect 2018.4.1.0
    ibm api connect 2018.4.1.7
    ibm powerai vision 1.1.3