medium6.7
CVE-2021-4178
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.
Impact
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Fabric8-Kubernetes | from 5.0.1 before 5.0.3 from 5.1.0 before 5.1.2 from 5.2.0 before 5.3.2 from 5.5.0 before 5.7.4 from 5.9.0 before 5.10.2 from 5.11.0 before 5.11.2 |
| Redhat | A-Mq Streams | Version 2.0.1 |
| Redhat | Build Of Quarkus | Version 2.2.5 |
| Redhat | Descision Manager | Version 7.0 |
| Redhat | Fuse | Version 7.11 |
| Redhat | Integration Camel K | All versions |
| Redhat | Integration Camel Quarkus | Version 2.2.1 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Process Automation | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/security/cve/CVE-2021-4178
- https://bugzilla.redhat.com/show_bug.cgi?id=2034388
- https://github.com/advisories/GHSA-98g7-rxmf-rrxm
- https://github.com/fabric8io/kubernetes-client/issues/3653
- https://access.redhat.com/security/cve/CVE-2021-4178
- https://bugzilla.redhat.com/show_bug.cgi?id=2034388
- https://github.com/advisories/GHSA-98g7-rxmf-rrxm
- https://github.com/fabric8io/kubernetes-client/issues/3653