GitHub Advisoryadvisory · Maven

GHSA-m8wh-mqgf-rr8g Code injection in Kubernetes Java Client

MEDIUM Published 2021-10-12 Modified 2021-10-12 Official page ↗

Aliases: CVE-2021-25738
Ecosystem: Maven
Packages: io.kubernetes:client-java
Severity: Moderate
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-502
Reviewed: 2021-10-12

Affected packages

• Maven io.kubernetes:client-java: < 11.0.1 → fixed in 11.0.1

Description

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.

Related

Alias · CVE (1)

CVE-2021-25738 Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution. vulnerability

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-502 Deserialization of Untrusted Data weakness

References