{"schema_version":"1.8.0","id":"CVE-2019-11251","published":"2020-02-03T16:15:11.140Z","modified":"2026-08-07T11:48:03.130669530Z","aliases":["GHSA-6qfg-8799-r575","GO-2022-0802"],"related":["openSUSE-SU-2025:15424-1"],"details":"The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubelet","events":[{"introduced":"36ea738c771d6b8a50df632f092f5805818476c3"},{"fixed":"8d84603a161b8760198ebdd6ba6f7af3e31cd0e8"},{"introduced":"f6da02f583256d1a15cc44a101c80bfa2080a46f"},{"fixed":"817c3eb40060b6a2b75ef350914781301514e226"},{"introduced":"f1cb295a73c9298232b9848aa1b4029e36fc91e5"},{"fixed":"958285cf3eef1a8072c9546395138c6940ec6e44"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.13.0"},{"fixed":"1.13.11"},{"introduced":"1.14.0"},{"fixed":"1.14.7"},{"introduced":"1.15.0"},{"fixed":"1.15.4"}],"source":"CPE_RANGE"}}],"versions":["kubernetes-1.14.1-beta.0","kubernetes-1.14.0-rc.1","kubernetes-1.14.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11251.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubernetes","events":[{"introduced":"ddf47ac13c1a9483ea035a79cd7c10005ff21a6d"},{"fixed":"25074a190ef2a07d8b0ed38734f2cb373edfb868"},{"introduced":"641856db18352033a0d96dbc99153fa3b27298e5"},{"fixed":"8fca2ec50a6133511b771a11559e24191b1aa2b4"},{"introduced":"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529"},{"fixed":"67d2fcf276fcd9cf743ad4be9a9ef5828adc082f"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.13.0"},{"fixed":"1.13.11"},{"introduced":"1.14.0"},{"fixed":"1.14.7"},{"introduced":"1.15.0"},{"fixed":"1.15.4"}],"source":"CPE_RANGE"}}],"versions":["v1.14.7-beta.0","v1.15.4-beta.0","v1.13.11-beta.0","v1.15.3","v1.14.6","v1.13.10","v1.15.3-beta.0","v1.14.6-beta.0","v1.13.10-beta.0","v1.15.2","v1.13.9","v1.14.5","v1.15.2-beta.0","v1.15.1","v1.14.5-beta.0","v1.13.9-beta.0","v1.14.4","v1.13.8","v1.15.0","v1.15.1-beta.0","v1.14.4-beta.0","v1.13.8-beta.0","v1.13.7","v1.14.3","v1.14.3-beta.0","v1.14.2","v1.13.7-beta.0","v1.13.6","v1.14.2-beta.0","v1.14.1","v1.14.1-beta.0","v1.13.6-beta.0","v1.14.0","v1.13.5","v1.13.5-beta.0","v1.13.4","v1.13.4-beta.0","v1.13.3","v1.13.3-beta.0","v1.13.2","v1.13.2-beta.0","v1.13.1","v1.13.1-beta.0","v1.13.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11251.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/kubernetes/kubernetes/issues/87773"},{"type":"ADVISORY","url":"https://groups.google.com/d/msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:kubernetes:kubernetes:1.1-1.12:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.1-1.12"},{"last_affected":"1.1-1.12"},{"introduced":"1.1-1.12"},{"last_affected":"1.1-1.12"}],"source":"CPE_STRING","vendor_product":"kubernetes:kubernetes"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"}]}