CVE-2020-8570

{"id": "CVE-2020-8570", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2021-01-21T17:15:14.327", "references": [{"url": "https://github.com/kubernetes-client/java/issues/1491", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrg", "tags": ["Mailing List", "Third Party Advisory"], "source": "jordan@liggitt.net"}, {"url": "https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E", "source": "jordan@liggitt.net"}, {"url": "https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E", "source": "jordan@liggitt.net"}, {"url": "https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E", "source": "jordan@liggitt.net"}, {"url": "https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E", "source": "jordan@liggitt.net"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "jordan@liggitt.net", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code."}, {"lang": "es", "value": "Las bibliotecas del cliente de Kubernetes Java en la versi\u00f3n 10.0.0 y las versiones anteriores a 9.0.1, permiten la escritura en rutas fuera del directorio actual cuando copia varios archivos desde un pod remoto que env\u00eda un archivo dise\u00f1ado maliciosamente. Esto potencialmente puede sobrescribir cualquier archivo en el sistema del proceso que ejecuta el c\u00f3digo del cliente"}], "lastModified": "2023-11-07T03:26:37.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDE8B8B0-BFEA-4097-B229-633ED83338B4", "versionEndExcluding": "9.0.2"}, {"criteria": "cpe:2.3:a:kubernetes:java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B367DA81-ECE3-40F2-B5D3-D9F95E5D7E14", "versionEndExcluding": "10.0.1", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "jordan@liggitt.net"}