VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Apr 22, 2019· Updated Jun 17, 2026

CVE-2019-11244

CVE-2019-11244

Description

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
k8s.io/client-goGo
>= 1.8.0, < 1.12.91.12.9

Affected products

6
  • Cri O/Kubernetes2 versions
    cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*range: >=1.8.0,<=1.14.1
    • (no CPE)range: v1.8.0
  • NetApp/Trident
    cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform2 versions
    cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:golang/k8s.io/client-go
    Range: >= 1.8.0, < 1.12.9

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.