CVE-2021-20218
High
Description
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
SeverityHigh
CVSS7.4
Exploit probability—
Product
Redhat Kubernetes-client
PublishedMar 16, 2021
First seenMar 16, 2021
Weakness typeCWE-22Path traversal
How to fix
Update
- redhat kubernetes-client4.7.2, 4.11.2, 4.13.2, 5.0.2 or later
- io.fabric8:kubernetes-client4.7.2, 4.11.2, 4.13.2, 5.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat kubernetes-client | 4.2.0 ≤ v < 4.7.2, 4.8.0 ≤ v < 4.11.2, 4.12.0 ≤ v < 4.13.2, 5.0.0 ≤ v < 5.0.2 | 4.7.2, 4.11.2, 4.13.2, 5.0.2 |
| redhat a-mq_online | No range specified | — |
| redhat build_of_quarkus | No range specified | — |
| redhat codeready_studio | 12.0 | — |
| redhat descision_manager | 7.0 | — |
| redhat integration_camel_k | No range specified | — |
| redhat jboss_fuse | 7.0.0 | — |
| redhat openshift_container_platform | 3.11 | — |
| redhat process_automation | 7.0 | — |
| io.fabric8:kubernetes-clientMaven | 4.2.0 ≤ v < 4.7.2, 4.8.0 ≤ v < 4.11.2, 4.12.0 ≤ v < 4.13.2, 5.0.0 ≤ v < 5.0.2 | 4.7.2, 4.11.2, 4.13.2, 5.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.