CVE-2021-20218 Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client
A malicious pod can exploit the fabric8 Kubernetes client copy command to extract files outside the intended directory, compromising integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20218?
CVE-2021-20218 is a high-severity path traversal vulnerability in Redhat Openshift Container Platform, published on 16 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
Weakness: CWE-22
Which versions are affected by CVE-2021-20218?
8 open source packages ship an affected version, including io.fabric8:kubernetes-client. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
io.fabric8:kubernetes-client Maven | From 4.12.0 | 4.13.2 |
io.fabric8:kubernetes-client Maven | From 4.12.0 | 4.13.2 |
io.fabric8:kubernetes-client Maven | From 4.2.0 | 4.7.2 |
io.fabric8:kubernetes-client Maven | From 4.2.0 | 4.7.2 |
io.fabric8:kubernetes-client Maven | From 4.8.0 | 4.11.2 |
io.fabric8:kubernetes-client Maven | From 4.8.0 | 4.11.2 |
2 more packages
io.fabric8:kubernetes-client Maven | From 5.0.0 | 5.0.2 |
io.fabric8:kubernetes-client Maven | From 5.0.0 | 5.0.2 |
Products include Redhat A-Mq Online, Redhat Build of Quarkus, Redhat Codeready Studio, Redhat Descision Manager, Redhat Integration Camel K, Redhat Jboss Fuse and 3 more.
How do I fix CVE-2021-20218?
Upgrade io.fabric8:kubernetes-client to a fixed version for your release line: 4.13.2, 4.7.2, 4.11.2 or 5.0.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-20218 being exploited?
There is no known exploitation of CVE-2021-20218 in the wild and no public exploit code.
Sources
Also known as GHSA-jwh2-ffg4-48xc.