CVE-2021-20218

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	fabric8-kubernetes-client	kubernetes-client-4.2.0 and after

References

https://bugzilla.redhat.com/show_bug.cgi?id=1923405Issue Tracking, Vendor Advisory
https://github.com/fabric8io/kubernetes-client/issues/2715Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1923405Issue Tracking, Vendor Advisory
https://github.com/fabric8io/kubernetes-client/issues/2715Patch, Third Party Advisory

Timeline

Published: Mar 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202195.5A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local a CVE-2021-20224.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.50 and prior, 5.CVE-2021-202204.8A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possi CVE-2021-202216.0An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0o CVE-2021-202227.5A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highes CVE-2021-202245.5An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to Ge CVE-2021-202256.7A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer b CVE-2021-202267.8A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of servic CVE-2021-202275.5A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries l CVE-2021-202287.5A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when CVE-2021-202294.3A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query CVE-2021-20234.7Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12