| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/kubeedge/kubeedge | ≥ 1.16.0, < 1.21.2≥ 1.22.0, < 1.22.2≥ 1.23.0, < 1.23.1 | 1.21.21.22.21.23.1 |
KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function.
Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.
The issue is particularly relevant to Windows edge nodes during the keadm join or installation process when keadm extracts downloaded component archives.
An attacker who can cause an affected keadm process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running keadm.
On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the keadm process, successful exploitation could lead to persistent system modification or code execution.
Exploitation requires the attacker to influence the contents of an archive processed by keadm, such as through a compromised, replaced, or otherwise untrusted download source.
The extraction logic now:
filepath-securejoin to ensure extracted files remain within the destination directory.Fixes are planned for the following maintained releases:
Until a patched release is available:
keadm;keadm;これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャンKubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.