A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fabric8-kubernetes | Redhat | 5.0.1 (including) | 5.0.3 (excluding) |
| Fabric8-kubernetes | Redhat | 5.1.0 (including) | 5.1.2 (excluding) |
| Fabric8-kubernetes | Redhat | 5.2.0 (including) | 5.3.2 (excluding) |
| Fabric8-kubernetes | Redhat | 5.5.0 (including) | 5.7.4 (excluding) |
| Fabric8-kubernetes | Redhat | 5.9.0 (including) | 5.10.2 (excluding) |
| Fabric8-kubernetes | Redhat | 5.11.0 (including) | 5.11.2 (excluding) |
| Fabric8-kubernetes | Redhat | 5.0.0-beta1 (including) | 5.0.0-beta1 (including) |
| Fabric8-kubernetes | Redhat | 5.8.0 (including) | 5.8.0 (including) |
| OCP-Tools-4.13-RHEL-8 | RedHat | jenkins-2-plugins-0:4.13.1684911916-1.el8 | * |
| Red Hat AMQ Streams 1.6.7 | RedHat | kubernetes-client | * |
| Red Hat AMQ Streams 2.0.1 | RedHat | kubernetes-client | * |
| Red Hat build of Quarkus 2.2.5 | RedHat | kubernetes-client | * |
| Red Hat Fuse 7.11 | RedHat | kubernetes-client | * |
| RHINT Camel-Q 2.2.1 | RedHat | kubernetes-client | * |
| Text-Only RHOAR | RedHat | kubernetes-client | * |