CVEvulnerability

CVE-2021-20218

7.4 HIGH Published 2021-03-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
CWE-22

Description

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Affected configurations

• redhat kubernetes-client (>= 4.2.0 < 4.7.2) • redhat kubernetes-client (>= 4.8.0 < 4.11.2) • redhat kubernetes-client (>= 4.12.0 < 4.13.2) • redhat kubernetes-client (>= 5.0.0 < 5.0.2) • redhat a-mq online • redhat build of quarkus • redhat codeready studio 12.0 • redhat descision manager 7.0 • redhat integration camel k • redhat jboss fuse 7.0.0 • redhat openshift container platform 3.11 • redhat process automation 7.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References