high7.4
CVE-2021-20218
Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client
Impact
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.fabric8:kubernetes-client | >= 4.2.0, <= 4.7.1 | 4.7.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Kubernetes-Client | from 4.2.0 before 4.7.2 from 4.8.0 before 4.11.2 from 4.12.0 before 4.13.2 from 5.0.0 before 5.0.2 |
| Redhat | A-Mq Online | All versions |
| Redhat | Build Of Quarkus | All versions |
| Redhat | Codeready Studio | Version 12.0 |
| Redhat | Descision Manager | Version 7.0 |
| Redhat | Integration Camel K | All versions |
| Redhat | Jboss Fuse | Version 7.0.0 |
| Redhat | Openshift Container Platform | Version 3.11 |
| Redhat | Process Automation | Version 7.0 |