CVE-2021-20218
Fixed in a distro release EPSS 1%
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
Products: redhat kubernetes-client, redhat a-mq_online, redhat build_of_quarkus, redhat codeready_studio, redhat descision_manager, redhat integration_camel_k, redhat jboss_fuse, redhat openshift_container_platform, redhat process_automation
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.fabric8:kubernetes-client | 4.7.2 |
| Maven | io.fabric8:kubernetes-client | 4.11.2 |
| Maven | io.fabric8:kubernetes-client | 4.13.2 |
| Maven | io.fabric8:kubernetes-client | 5.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.7 | cri-o | 0:1.20.2-4.rhaos4.7.gitd5a999a.el7 |
| Red Hat openshift 4.7 | cri-o | 0:1.20.2-4.rhaos4.7.gitd5a999a.el8 |
| Red Hat openshift 4.7 | cri-o-debuginfo | 0:1.20.2-4.rhaos4.7.gitd5a999a.el7 |
| Red Hat openshift 4.7 | cri-o-debuginfo | 0:1.20.2-4.rhaos4.7.gitd5a999a.el8 |
| Red Hat openshift 4.7 | cri-o-debugsource | 0:1.20.2-4.rhaos4.7.gitd5a999a.el8 |
| Red Hat openshift 4.7 | jenkins-2-plugins | 0:4.7.1616671397-1.el8 |
| Red Hat openshift 4.7 | openshift-clients | 0:4.7.0-202103251046.p0.git.3957.c4da68b.el7 |
| Red Hat openshift 4.7 | openshift-clients | 0:4.7.0-202103251046.p0.git.3957.c4da68b.el8 |
| Red Hat openshift 4.7 | openshift-clients-redistributable | 0:4.7.0-202103251046.p0.git.3957.c4da68b.el7 |
| Red Hat openshift 4.7 | openshift-clients-redistributable | 0:4.7.0-202103251046.p0.git.3957.c4da68b.el8 |