{"schema_version":"1.8.0","id":"CVE-2018-1002100","published":"2018-06-02T01:29:02.110Z","modified":"2026-08-07T11:31:07.028230323Z","aliases":["GHSA-2jq6-ffph-p4h8","GO-2023-1959"],"related":["openSUSE-SU-2025:15424-1"],"details":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubernetes","events":[{"introduced":"0b9efaeb34a2fc51ff8e4d34ad9bc6375459c4a4"},{"last_affected":"c2bd642c70b3629223ea3b7db566a267a1e2d0df"},{"introduced":"925c127ec6b946659ad0fd596fa959be43f0cc05"},{"last_affected":"f01a2bf98249a4db383560443a59bed0c13575df"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8.0"},{"last_affected":"1.8.15"},{"introduced":"1.9.0"},{"last_affected":"1.9.5"}],"source":"CPE_RANGE"}}],"versions":["v1.8.15","v1.8.14","v1.8.15-beta.0","v1.8.14-beta.0","v1.8.13","v1.8.13-beta.0","v1.8.12","v1.8.12-beta.0","v1.8.11","v1.8.11-beta.0","v1.8.10","v1.9.5","v1.9.5-beta.0","v1.8.10-beta.0","v1.9.4","v1.8.9","v1.9.3","v1.8.9-beta.0","v1.8.8","v1.9.4-beta.0","v1.9.2","v1.9.3-beta.0","v1.8.8-beta.0","v1.8.7","v1.9.2-beta.0","v1.9.1","v1.8.7-beta.0","v1.8.6","v1.9.1-beta.0","v1.9.0","v1.8.6-beta.0","v1.8.5","v1.8.5-beta.0","v1.8.4","v1.8.4-beta.0","v1.8.3","v1.8.3-beta.0","v1.8.2","v1.8.2-beta.0","v1.8.1","v1.8.1-beta.0","v1.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1002100.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/kubernetes/kubernetes/issues/61297"},{"type":"ADVISORY","url":"https://hansmi.ch/articles/2018-04-openshift-s2i-security"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564305"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.5.0"},{"last_affected":"1.5.9"},{"introduced":"1.5.0"},{"last_affected":"1.5.9"},{"introduced":"1.6.0"},{"last_affected":"1.6.14"},{"introduced":"1.6.0"},{"last_affected":"1.6.14"},{"introduced":"1.7.0"},{"last_affected":"1.7.17"},{"introduced":"1.7.0"},{"last_affected":"1.7.17"}],"source":"CPE_RANGE","vendor_product":"kubernetes:kubernetes"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}