CVE-2020-8570: Path Traversal in the Java Kubernetes Client
Summary
CVE-2020-8570: Path Traversal in the Java Kubernetes Client. Affects io.kubernetes:client-java across 2 version ranges.
< 9.0.2
>= 10.0.0, < 10.0.1
Fixed in 9.0.2 or 10.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Java Kubernetes Client is a library that provides a Java interface for interacting with the Kubernetes API. It allows developers to manage and control Kubernetes resources programmatically. The client library is widely used in Java applications that interact with Kubernetes clusters. However, versions 10.0.0 and earlier than 9.0.1 of the client library are vulnerable to a path traversal vulnerability.
Vulnerability Detail
The path traversal vulnerability in the Java Kubernetes Client allows an attacker to write files outside of the current directory when copying multiple files from a remote pod. This vulnerability can be exploited by a maliciously crafted archive sent by the pod. If successfully exploited, the attacker can overwrite any files on the system where the client code is executed. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 9.0.29.0.2 -
>= 10.0.0, < 10.0.110.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Java Kubernetes Client library to the fixed versions.
Conclusion
The path traversal vulnerability in the Java Kubernetes Client can lead to unauthorized access, data loss, or system compromise. It is crucial to update the client library to the fixed versions (9.0.2 or later for versions prior to 9.0.1, and 10.0.1 or later for version 10.0.0) to mitigate this vulnerability. For additional support, please contact DevNack.com.
See every vulnerability recorded for io.kubernetes:client-java →
FAQ
The vulnerability allows an attacker to overwrite files on the system where the client code is executed, potentially leading to unauthorized access, data loss, or system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your pom.xml file to the playground, and it will analyze your dependencies and alert you if any vulnerabilities, including this one, are found.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the client library to the fixed versions to prevent potential exploitation.
No, updating the Java Kubernetes Client library to the fixed versions is the only known mitigation for this vulnerability.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.kubernetes:client-java.
