CVE-2020-8570 json
Kubernetes Java client libraries unvalidated path traversal in Copy implementation
published 2021-01-21 5 y ago modified 2026-06-17 4 mo ago also GHSA-cghx-9gcr-r42x , EUVD-2021-0501
- cvss
- 9.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.7%
- EPSS 3.7% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Patch / fix
- maven io.kubernetes:client-java 9.0.2, 10.0.1
- Kubernetes Kubernetes Java Client 9.0.2, 10.0.1
- github.com/kubernetes-client/java@858316a commit
- github.com/kubernetes-client/java#1450 pull request
- github.com/kubernetes-client/java/issues/1491 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-8570 updated cvss 7.4
kubernetes-client: Path Traversal bug in the Java kubernetes client
-
Red Hat Decision Manager 7 kubernetes-client Red Hat Fuse 7 kubernetes-client Red Hat Integration Camel K 1 kubernetes-client Red Hat JBoss Fuse 6 kubernetes-client Red Hat Process Automation 7 kubernetes-clientnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.69% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.kubernetes:client-java | <9.0.2 >=10.0.0, <10.0.1 |
9.0.2 10.0.1 |
Affected products
- Kubernetes Kubernetes Java Client
Classification
References
-
github.com
/kubernetes-client/java/issues/1491
web, issue-tracking, patch, third-party-advisory
-
github.com
/kubernetes-client/java/pull/1450
web
-
github.com
/kubernetes-client/java/commit/858316ae8bc1145005a0310e1f65f95d2389a589
web
-
groups.google.com
/g/kubernetes-security-announce/c/sd5h73sFPrg
web, mailing-list, third-party-advisory
-
lists.apache.org
/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2020-8570
advisory
-
github.com
/kubernetes-client/java
package
-
lists.apache.org
/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E
web
-
lists.apache.org
/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E
web
-
lists.apache.org
/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3@%3Ccommits.druid.apache.org%3E
web
-
lists.apache.org
/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6@%3Ccommits.druid.apache.org%3E
web
Sources
- CVE List CVE-2020-8570
- GitHub Advisory GHSA-cghx-9gcr-r42x
- NVD CVE-2020-8570
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.