6.7

CVE-2021-4178

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Fabric8-kubernetes Version >= 5.0.1 < 5.0.3
Redhat ≫ Fabric8-kubernetes Version >= 5.1.0 < 5.1.2
Redhat ≫ Fabric8-kubernetes Version >= 5.2.0 < 5.3.2
Redhat ≫ Fabric8-kubernetes Version >= 5.5.0 < 5.7.4
Redhat ≫ Fabric8-kubernetes Version >= 5.9.0 < 5.10.2
Redhat ≫ Fabric8-kubernetes Version >= 5.11.0 < 5.11.2
Redhat ≫ Fabric8-kubernetes Version5.0.0 Updatebeta1
Redhat ≫ Fabric8-kubernetes Version5.8.0
Redhat ≫ A-mq Streams Version2.0.1
Redhat ≫ Build Of Quarkus Version2.2.5
Redhat ≫ Descision Manager Version7.0
Redhat ≫ Fuse Version7.11
Redhat ≫ Process Automation Version7.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.08% 0.254
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.