Описание
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
Отчет
Red Hat CodeReady Studio 12 is not affected by this flaw because it does not ship a vulnerable version of kubernetes-client; the version that it ships does not use SnakeYAML.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Quarkus | kubernetes-client | Affected | ||
| Red Hat CodeReady Studio 12 | kubernetes-client | Not affected | ||
| Red Hat Decision Manager 7 | kubernetes-client | Affected | ||
| Red Hat Integration Camel K 1 | kubernetes-client | Affected | ||
| Red Hat JBoss Fuse 6 | kubernetes-client | Not affected | ||
| Red Hat OpenShift Container Platform 4 | jenkins-2-plugins | Affected | ||
| Red Hat Process Automation 7 | kubernetes-client | Affected | ||
| OCP-Tools-4.13-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2023:3299 | 24.05.2023 |
| Red Hat AMQ Streams 1.6.7 | kubernetes-client | Fixed | RHSA-2022:0467 | 08.02.2022 |
| Red Hat AMQ Streams 2.0.1 | kubernetes-client | Fixed | RHSA-2022:0469 | 08.02.2022 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-502
https://bugzilla.redhat.com/show_bug.cgi?id=2034388kubernetes-client: Insecure deserialization in unmarshalYaml method
6.7 Medium
CVSS3
Связанные уязвимости
CVSS3: 6.7
nvd
больше 3 лет назад
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
6.7 Medium
CVSS3