CVE-2021-4178 fabric8 kubernetes-client vulnerable
A local privileged attacker can execute arbitrary code by supplying malicious YAML to the Fabric 8 Kubernetes client due to improper parsing configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4178?
CVE-2021-4178 is a medium-severity unsafe deserialization vulnerability in kubernetes-client, published on 24 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
Weakness: CWE-502
Which versions are affected by CVE-2021-4178?
14 open source packages ship an affected version, including io.fabric8:kubernetes-client. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
io.fabric8:kubernetes-client Maven | From 5.0.0-beta-1 | 5.0.3 |
io.fabric8:kubernetes-client Maven | From 5.0.0-beta-1 | 5.0.3 |
io.fabric8:kubernetes-client Maven | From 5.1.0 | 5.1.2 |
io.fabric8:kubernetes-client Maven | From 5.1.0 | 5.1.2 |
io.fabric8:kubernetes-client Maven | From 5.11.0 | 5.11.2 |
io.fabric8:kubernetes-client Maven | From 5.11.0 | 5.11.2 |
8 more packages
io.fabric8:kubernetes-client Maven | From 5.2.0 | 5.3.2 |
io.fabric8:kubernetes-client Maven | From 5.2.0 | 5.3.2 |
io.fabric8:kubernetes-client Maven | From 5.5.0 | 5.7.4 |
io.fabric8:kubernetes-client Maven | From 5.5.0 | 5.7.4 |
io.fabric8:kubernetes-client Maven | From 5.8.0 | 5.8.1 |
io.fabric8:kubernetes-client Maven | From 5.8.0 | 5.8.1 |
io.fabric8:kubernetes-client Maven | From 5.9.0 | 5.10.2 |
io.fabric8:kubernetes-client Maven | From 5.9.0 | 5.10.2 |
Products include Redhat A-Mq Streams, Redhat Build of Quarkus, Redhat Descision Manager, Redhat Fabric8-Kubernetes, Redhat Fuse, Redhat Integration Camel K and 3 more.
How do I fix CVE-2021-4178?
Upgrade io.fabric8:kubernetes-client to a fixed version for your release line: 5.0.3, 5.1.2, 5.11.2 or 5.3.2.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-4178 being exploited?
There is no known exploitation of CVE-2021-4178 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in kubernetes-client
Sources
Also known as GHSA-98g7-rxmf-rrxm.