PT-2022-11483 · Unknown · Fabric 8 Kubernetes Client

Jordy + 1 · Published 2022-07-15 · Updated 2022-10-04 · CVE-2021-4178

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fabric 8 Kubernetes client versions 5.0.0-beta-1 and above

Description A flaw was found in the Fabric 8 Kubernetes client due to improperly configured YAML parsing, allowing a local and privileged attacker to supply malicious YAML, which can lead to arbitrary code execution.

Recommendations For versions 5.0.0-beta-1 and above, consider disabling the YAML parsing functionality until a patch is available to prevent exploitation. Restrict access to the Fabric 8 Kubernetes client to minimize the risk of exploitation by a local and privileged attacker. Avoid using the client with untrusted input to prevent the supply of malicious YAML. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2021-4178

GHSA-98G7-RXMF-RRXM

RHSA-2023:3299

Affected Products

Fabric 8 Kubernetes Client

References · 14

• https://bugzilla.redhat.com/show_bug.cgi?id=2034388 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4178 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2021-4178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4178 · Security Note
• https://osv.dev/vulnerability/GHSA-98g7-rxmf-rrxm · Vendor Advisory
• https://github.com/fabric8io/kubernetes-client/issues/3653 · Note
• https://github.com/fabric8io/kubernetes-client/commit/445103004d1ed3153d5abb272473451d05891e39 · Note
• https://github.com/fabric8io/kubernetes-client · Note
• https://t.me/cvenotify/35315 · Telegram Post
• https://t.me/cibsecurity/48665 · Telegram Post
• https://github.com/advisories/GHSA-98g7-rxmf-rrxm · Note
• https://mend.io/vulnerability-database/CVE-2021-4178 · Note
• https://t.me/cvenotify/35075 · Telegram Post
• https://access.redhat.com/security/cve/cve-2021-4178 · Note