CVE-2021-4178: A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above

Description

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 27% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AS

A-mq Streams · Redhat

2.0.1 · source: NVD

BO

Build OF Quarkus · Redhat

2.2.5 · source: NVD

DM

Descision Manager · Redhat

7.0 · source: NVD

FA

Fabric8-kubernetes · Redhat

5.0.1 before 5.0.3; 5.1.0 before 5.1.2; 5.2.0 before 5.3.2; 5.5.0 before 5.7.4; 5.9.0 before 5.10.2; 5.11.0 before 5.11.2; +2 more · source: NVD

FU

Fuse · Redhat

7.11 · source: NVD

IC

Integration Camel K · Redhat

All versions, or not specified · source: NVD

IC

Integration Camel Quarkus · Redhat

2.2.1 · source: NVD

OA

Openshift Application Runtimes · Redhat

All versions, or not specified · source: NVD

PA

Process Automation · Redhat

7.0 · source: NVD