CVE-2021-20218

Published: Mar 16, 2021Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Affected (12)

Products: Redhat: Kubernetes Client, A Mq Online, Build Of Quarkus, Codeready Studio, Descision Manager, Integration Camel K, Jboss Fuse, Openshift Container Platform, Process Automation

9 products

Openshift Container Platform

Process Automation

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Kubernetes Client	From 4.12.0 to 4.13.2
Redhat Kubernetes Client	From 4.2.0 to 4.7.2
Redhat Kubernetes Client	From 4.8.0 to 4.11.2
Redhat Kubernetes Client	From 5.0.0 to 5.0.2

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Redhat A Mq Online	All versions
Redhat Build Of Quarkus	All versions
Redhat Codeready Studio	Version 12.0
Redhat Descision Manager	Version 7.0
Redhat Integration Camel K	All versions
Redhat Jboss Fuse	Version 7.0.0
Redhat Openshift Container Platform	Version 3.11
Redhat Process Automation	Version 7.0