Velero vulnerable to file path traversal when extracting from backup's tarball
What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape_1 -> file created at /tmp/escape_1 ../../../../../../../../tmp/escape_2 -> file created at /tmp/escape_2 ../../../tmp/cron_poc -> would be /etc/cron.d/backdoor in real attack ../../../tmp/ssh_poc -> would be ~/.ssh/authorized_keys ../../../tmp/kubeconfig_poc -> would be ~/.kube/config It's possible that extracting files from the tarball during restore …