CVE-2021-4178

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	kubernetes-client	Affects 5.x versions, Fixed in kubernetes-client v5.0.3 and above.

References

https://access.redhat.com/security/cve/CVE-2021-4178Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034388Issue Tracking, Vendor Advisory
https://github.com/advisories/GHSA-98g7-rxmf-rrxmThird Party Advisory
https://github.com/fabric8io/kubernetes-client/issues/3653Issue Tracking, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-4178Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034388Issue Tracking, Vendor Advisory
https://github.com/advisories/GHSA-98g7-rxmf-rrxmThird Party Advisory
https://github.com/fabric8io/kubernetes-client/issues/3653Issue Tracking, Third Party Advisory

Timeline

Published: Aug 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-417807.8Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu CVE-2021-417817.8Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu CVE-2021-417827.8Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu CVE-2021-417837.8Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu CVE-2021-417847.8Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu CVE-2021-417857.8Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu CVE-2021-417887.5MediaTek microchips, as used in NETGEAR devices through 2021-12-13 and other devices, mishandle attempts at Wi-Fi authentication flooding. (CVE-2021-417896.5In wifi driver, there is a possible system crash due to a missing validation check. This could lead to remote denial of service from a proxi CVE-2021-41795.4livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-417908.8An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts u CVE-2021-417915.4An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS fil CVE-2021-417925.3An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services throu