CVE-2021-4178
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
- Score
- CVSS 3.1 6.7 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2022-08-24
- Last modified
- 2024-08-03
- Weaknesses
- CWE-502
Affected products
- A-mq Streams (Redhat)
- Build Of Quarkus (Redhat)
- Descision Manager (Redhat)
- Fabric8-kubernetes (Redhat)
- Fuse (Redhat)
- Integration Camel K (Redhat)
- Integration Camel Quarkus (Redhat)
- Openshift Application Runtimes (Redhat)
- Process Automation (Redhat)
References
- https://access.redhat.com/security/cve/CVE-2021-4178
- https://bugzilla.redhat.com/show_bug.cgi?id=2034388
- https://github.com/advisories/GHSA-98g7-rxmf-rrxm
- https://github.com/fabric8io/kubernetes-client/issues/3653
