CVE-2021-4178
Fixed in a distro release EPSS <1%
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
Products: redhat fabric8-kubernetes, redhat a-mq_streams, redhat build_of_quarkus, redhat descision_manager, redhat fuse, redhat integration_camel_k, redhat integration_camel_quarkus, redhat openshift_application_runtimes, redhat process_automation
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.fabric8:kubernetes-client | 5.0.3 |
| Maven | io.fabric8:kubernetes-client | 5.1.2 |
| Maven | io.fabric8:kubernetes-client | 5.3.2 |
| Maven | io.fabric8:kubernetes-client | 5.7.4 |
| Maven | io.fabric8:kubernetes-client | 5.8.1 |
| Maven | io.fabric8:kubernetes-client | 5.10.2 |
| Maven | io.fabric8:kubernetes-client | 5.11.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ocp tools 4.13 | jenkins | 0:2.387.3.1684911776-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1684911916-1.el8 |