PT-2021-13849 · Unknown · Fabric 8 Kubernetes Client

Ivan Bodrov + 1 · Published 2021-03-16 · Updated 2022-05-24 · CVE-2021-20218

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: fabric8 kubernetes-client versions 4.2.0 and after

Description: A flaw was found in the fabric8 kubernetes-client that allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability.

Recommendations: For versions prior to 4.7.2, update to kubernetes-client-4.7.2. For versions prior to 4.11.2, update to kubernetes-client-4.11.2. For versions prior to 4.13.2, update to kubernetes-client-4.13.2. For versions prior to 5.0.2, update to kubernetes-client-5.0.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-20218

GHSA-JWH2-FFG4-48XC

RHSA-2021:1006

Affected Products

Fabric 8 Kubernetes Client

References · 6

• https://github.com/fabric8io/kubernetes-client/issues/2715 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1923405 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jwh2-ffg4-48xc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20218 · Security Note
• https://t.me/cibsecurity/24977 · Telegram Post