CVE-2021-4178

Published: Aug 24, 2022Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

Affected (16)

Products: Redhat: Fabric8 Kubernetes, A Mq Streams, Build Of Quarkus, Descision Manager, Fuse, Integration Camel K, Integration Camel Quarkus, Openshift Application Runtimes, Process Automation

9 products

Integration Camel Quarkus

Openshift Application Runtimes

Process Automation

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Fabric8 Kubernetes	5.0.1 ≤ version < 5.0.3
Redhat Fabric8 Kubernetes	5.1.0 ≤ version < 5.1.2
Redhat Fabric8 Kubernetes	5.11.0 ≤ version < 5.11.2
Redhat Fabric8 Kubernetes	5.2.0 ≤ version < 5.3.2
Redhat Fabric8 Kubernetes	5.5.0 ≤ version < 5.7.4
Redhat Fabric8 Kubernetes	5.9.0 ≤ version < 5.10.2
Redhat Fabric8 Kubernetes	Version 5.0.0 beta1
Redhat Fabric8 Kubernetes	Version 5.8.0

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Redhat A Mq Streams	Version 2.0.1
Redhat Build Of Quarkus	Version 2.2.5
Redhat Descision Manager	Version 7.0
Redhat Fuse	Version 7.11
Redhat Integration Camel K	All versions
Redhat Integration Camel Quarkus	Version 2.2.1
Redhat Openshift Application Runtimes	All versions
Redhat Process Automation	Version 7.0