Description
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Remediation
References
https://github.com/kubernetes-client/java/issues/1491
https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrg
https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E
Related Vulnerabilities
CVE-2023-48967 Vulnerability in maven package org.noear:solon.serialization.fury
CVE-2020-36649 Vulnerability in npm package papaparse
CVE-2018-14627 Vulnerability in maven package org.wildfly:wildfly-feature-pack
CVE-2021-41183 Vulnerability in maven package org.webjars.bower:jquery-ui
CVE-2023-46122 Vulnerability in maven package org.scala-sbt:io_2.12