CVE-2021-4178
| Affected software | 9 products, listed below |
|---|---|
| Severity | 6.7 Medium CVSS 3.1 |
| Fixed in | 5.0.3, 5.1.2, 5.3.2, 5.7.4, 5.8.1, 5.10.2, 5.11.2 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 24 Aug 2022 |
| Updated | 17 Jun 2026 |
Description
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
CWE-94 · Code injection
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 4 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 0.34% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization, Process
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR deserialization security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-502: Deserialization of Untrusted Data. |
| Candidate fix | https://bugzilla.redhat.com/show_bug.cgi?id=2034388 : a Red Hat bug: the triage, which links onward to the fix |
How to mitigate CVE-2021-4178
Upgrade the affected software to a release that fixes it: 5.0.3, 5.1.2, 5.3.2, 5.7.4, 5.8.1, 5.10.2 or 5.11.2. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
io.fabric8:kubernetes-client |
5.0.0-beta-1 | 5.0.3 |
unbounded |
io.fabric8:kubernetes-client |
5.1.0 | 5.1.2 |
unbounded |
io.fabric8:kubernetes-client |
5.2.0 | 5.3.2 |
unbounded |
io.fabric8:kubernetes-client |
5.5.0 | 5.7.4 |
unbounded |
io.fabric8:kubernetes-client |
5.8.0 | 5.8.1 |
unbounded |
io.fabric8:kubernetes-client |
5.9.0 | 5.10.2 |
unbounded |
io.fabric8:kubernetes-client |
5.11.0 | 5.11.2 |
unbounded |
Products and versions
10 products, 23 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | io.fabric8 | kubernetes-client | generic | ≥ 5.0.0 and ＜ 5.0.3 · ≥ 5.1.0 and ＜ 5.1.2 · ≥ 5.2.0 and ＜ 5.3.2 · ≥ 5.5.0 and ＜ 5.7.4 · ≥ 5.8.0 and ＜ 5.8.1 · ≥ 5.9.0 and ＜ 5.10.2 · ≥ 5.11.0 and ＜ 5.11.2 |
| nvd | redhat | a-mq streams | generic | 2.0.1 |
| nvd | redhat | build of quarkus | generic | 2.2.5 |
| nvd | redhat | descision manager | generic | 7.0 |
| nvd | redhat | fabric8-kubernetes | generic | 5.0.0:beta1 · ≥ 5.0.1 and ＜ 5.0.3 · ≥ 5.1.0 and ＜ 5.1.2 · ≥ 5.2.0 and ＜ 5.3.2 · ≥ 5.5.0 and ＜ 5.7.4 · 5.8.0 · ≥ 5.9.0 and ＜ 5.10.2 · ≥ 5.11.0 and ＜ 5.11.2 |
| nvd | redhat | fuse | generic | 7.11 |
| nvd | redhat | integration camel k | generic | any version |
| nvd | redhat | integration camel quarkus | generic | 2.2.1 |
| nvd | redhat | openshift application runtimes | generic | any version |
| nvd | redhat | process automation | generic | 7.0 |
References
Timeline
Timeline
| Published | 2022-08-24 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |