CVE-2021-4178: fabric8 kubernetes-client Arbitrary Code Execution
Summary
CVE-2021-4178: fabric8 kubernetes-client vulnerable. Affects io.fabric8:kubernetes-client across 7 version ranges.
>= 5.0.0-beta-1, < 5.0.3
>= 5.1.0, < 5.1.2
>= 5.2.0, < 5.3.2
>= 5.5.0, < 5.7.4
>= 5.8.0, < 5.8.1
>= 5.9.0, < 5.10.2
>= 5.11.0, < 5.11.2
Fixed in 7 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fabric8 Kubernetes client is a Maven package that provides a Java API for interacting with Kubernetes clusters. It allows developers to manage and control Kubernetes resources programmatically. The vulnerability identified as CVE-2021-4178 affects fabric8 Kubernetes client versions 5.0.0-beta-1 and higher. This vulnerability arises from a misconfigured YAML parsing mechanism, which enables attackers to inject malicious YAML files into the system.
Vulnerability Detail
The vulnerability in fabric8 Kubernetes client allows for arbitrary code execution. By exploiting the misconfigured YAML parsing, attackers can insert malicious YAML files, which may lead to the execution of arbitrary code. This can result in unauthorized access, data breaches, and potential compromise of the entire Kubernetes cluster. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.7.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.0.0-beta-1, < 5.0.35.0.3 -
>= 5.1.0, < 5.1.25.1.2 -
>= 5.2.0, < 5.3.25.3.2 -
>= 5.5.0, < 5.7.45.7.4 -
>= 5.8.0, < 5.8.15.8.1 -
>= 5.9.0, < 5.10.25.10.2
Show all 7 release lines
-
>= 5.11.0, < 5.11.25.11.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to update the fabric8 Kubernetes client to the fixed versions as soon as possible to mitigate the risk of arbitrary code execution.
Conclusion
The fabric8 Kubernetes client is vulnerable to arbitrary code execution due to a misconfigured YAML parsing mechanism. It is crucial to update to the fixed versions of the package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.fabric8:kubernetes-client →
FAQ
fabric8 Kubernetes client is a Maven package that provides a Java API for interacting with Kubernetes clusters. It allows developers to manage and control Kubernetes resources programmatically.
Versions 5.0.0-beta-1 and higher of fabric8 Kubernetes client are affected by this vulnerability.
This vulnerability allows attackers to execute arbitrary code by injecting malicious YAML files. It can lead to unauthorized access, data breaches, and compromise of the Kubernetes cluster.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.7.
To fix this vulnerability, update the fabric8 Kubernetes client to the fixed versions: 5.0.3, 5.1.2, 5.3.2, 5.7.4, 5.8.1, 5.10.2, or 5.11.2.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.fabric8:kubernetes-client.
