fabric8 kubernetes-client vulnerable

2022-07-1505:17:35

Google

osv.dev

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

17.0%

JSON

fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.

CPENameOperatorVersion
io.fabric8:kubernetes-clienteq5.2.1
io.fabric8:kubernetes-clienteq5.2.0
io.fabric8:kubernetes-clienteq5.7.3
io.fabric8:kubernetes-clienteq5.0.0
io.fabric8:kubernetes-clienteq5.0.0-beta-1
io.fabric8:kubernetes-clienteq5.1.1
io.fabric8:kubernetes-clienteq5.5.0
io.fabric8:kubernetes-clienteq5.11.0
io.fabric8:kubernetes-clienteq5.11.1
io.fabric8:kubernetes-clienteq5.7.2

Name	Operator	Version
io.fabric8:kubernetes-client	eq	5.2.1
io.fabric8:kubernetes-client	eq	5.2.0
io.fabric8:kubernetes-client	eq	5.7.3
io.fabric8:kubernetes-client	eq	5.0.0
io.fabric8:kubernetes-client	eq	5.0.0-beta-1
io.fabric8:kubernetes-client	eq	5.1.1
io.fabric8:kubernetes-client	eq	5.5.0
io.fabric8:kubernetes-client	eq	5.11.0
io.fabric8:kubernetes-client	eq	5.11.1
io.fabric8:kubernetes-client	eq	5.7.2