Skip to content
OpenAdvisories
Medium · 6.7 CVE-2021-25738 EUVD-2021-2229GHSA-m8wh-mqgf-rr8g

Code exec via yaml parsing

Published Oct 11, 2021 · Updated Sep 16, 2024 · Assigned by kubernetes

Vendor: Kubernetes Product: Kubernetes Java Client Package: io.kubernetes:client-java Ecosystem: Maven

Description

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.

Affected products

VendorProductAffectedFixed
Kubernetes Kubernetes Java Client v12.0.0, unspecified – ≤ v11.0.1, unspecified – ≤ v10.0.1, unspecified – ≤ v9.0.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.kubernetes:client-java < 11.0.1 11.0.1 GHSA-m8wh-mqgf-rr8g

References