Security Bulletin: IBM Event Streams is vulnerable to arbitrary code execution due to the Fabric8 Kubernetes client (CVE-2021-4178)

Summary

There is a vulnerability in the Fabric8 Kubernetes client. The library is used by IBM Event Streams.

Vulnerability Details

CVEID:CVE-2021-4178
**DESCRIPTION:**Fabric8 Kubernetes client could allow a local authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization due to improperly configured YAML parsing. By using a specially-crafted YAML file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 6.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222690 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

10.4.0, 10.5.0, 11.0.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading

IBM Event Streams (Continuous Delivery)

• Upgrade to IBM Event Streams 11.0.1 by following the upgrading and migrating documentation.

Workarounds and Mitigations

None