CVE-2021-4178

State: Published
Severity: Not scored
Published: Aug 24, 2022
Updated: Aug 3, 2024
Reserved: Dec 27, 2021

Description

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

Scores

The record has no CVSS score.

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
kubernetes-clientn/a	Affects 5.x versions, Fixed in kubernetes-client v5.0.3 and above.Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=2034388
https://access.redhat.com/security/cve/CVE-2021-4178
https://github.com/advisories/GHSA-98g7-rxmf-rrxm
https://github.com/fabric8io/kubernetes-client/issues/3653

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.