~ / search / GHSA-98g7-rxmf-rrxm

GHSA-98g7-rxmf-rrxm

fabric8 kubernetes-client vulnerable

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-4178

Packages

EcosystemPackageAffectedFixed in
Maven io.fabric8:kubernetes-client >= 5.0.0-beta-1, < 5.0.3 5.0.3
Maven io.fabric8:kubernetes-client >= 5.1.0, < 5.1.2 5.1.2
Maven io.fabric8:kubernetes-client >= 5.2.0, < 5.3.2 5.3.2
Maven io.fabric8:kubernetes-client >= 5.5.0, < 5.7.4 5.7.4
Maven io.fabric8:kubernetes-client >= 5.8.0, < 5.8.1 5.8.1
Maven io.fabric8:kubernetes-client >= 5.9.0, < 5.10.2 5.10.2
Maven io.fabric8:kubernetes-client >= 5.11.0, < 5.11.2 5.11.2

Details

As written in the advisory (Markdown source, shown as plain text).

fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.

References

External links from the advisory. They lead to third-party sites.