exploitDog

CVE-2021-4178

Опубликовано: 24 авг. 2022

Источник: nvd

CVSS3: 6.7

EPSS Низкий

Описание

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

Ссылки

https://access.redhat.com/security/cve/CVE-2021-4178
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034388
Issue Tracking
Vendor Advisory
https://github.com/advisories/GHSA-98g7-rxmf-rrxm
Third Party Advisory
https://github.com/fabric8io/kubernetes-client/issues/3653
Issue Tracking
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-4178
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034388
Issue Tracking
Vendor Advisory
https://github.com/advisories/GHSA-98g7-rxmf-rrxm
Third Party Advisory
https://github.com/fabric8io/kubernetes-client/issues/3653
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:fabric8-kubernetes:*:*:*:*:*:*:*:*

Версия от 5.0.1 (включая) до 5.0.3 (исключая)

cpe:2.3:a:redhat:fabric8-kubernetes:*:*:*:*:*:*:*:*

Версия от 5.1.0 (включая) до 5.1.2 (исключая)

cpe:2.3:a:redhat:fabric8-kubernetes:*:*:*:*:*:*:*:*

Версия от 5.2.0 (включая) до 5.3.2 (исключая)

cpe:2.3:a:redhat:fabric8-kubernetes:*:*:*:*:*:*:*:*

Версия от 5.5.0 (включая) до 5.7.4 (исключая)

cpe:2.3:a:redhat:fabric8-kubernetes:*:*:*:*:*:*:*:*

Версия от 5.9.0 (включая) до 5.10.2 (исключая)

cpe:2.3:a:redhat:fabric8-kubernetes:*:*:*:*:*:*:*:*

Версия от 5.11.0 (включая) до 5.11.2 (исключая)

cpe:2.3:a:redhat:fabric8-kubernetes:5.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:redhat:fabric8-kubernetes:5.8.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:redhat:a-mq_streams:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:build_of_quarkus:2.2.5:*:*:*:*:*:*:*

cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:fuse:7.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:integration_camel_quarkus:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00096

Низкий

6.7 Medium

CVSS3

Дефекты

CWE-502

CWE-502

Связанные уязвимости

CVE-2021-4178

CVSS3: 6.7

redhat

около 4 лет назад

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

GHSA-98g7-rxmf-rrxm

CVSS3: 6.7

github

больше 3 лет назад

fabric8 kubernetes-client vulnerable

EPSS

Процентиль: 27%

0.00096

Низкий

6.7 Medium

CVSS3

Дефекты

CWE-502

CWE-502