Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N — Medium 6.8 A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows ...

[SECURITY] Fedora 42 Update: kubernetes1.31-1.31.12-1.fc42

Production-Grade Container Scheduling and Management. Installs kubelet, the kubernetes agent on each machine in a cluster. The kubernetes-client sub-package, containing kubectl, is recommended but not strictly required. The kubernetes-client sub-package should be installed on control plane machin...

[SECURITY] Fedora 42 Update: kubernetes1.32-1.32.8-1.fc42

Production-Grade Container Scheduling and Management. Installs kubelet, the kubernetes agent on each machine in a cluster. The kubernetes-client sub-package, containing kubectl, is recommended but not strictly required. The kubernetes-client sub-package should be installed on control plane machin...

[SECURITY] Fedora 42 Update: kubernetes1.33-1.33.4-1.fc42

Production-Grade Container Scheduling and Management. Installs kubelet, the kubernetes agent on each machine in a cluster. The kubernetes-client sub-package, containing kubectl, is recommended but not strictly required. The kubernetes-client sub-package should be installed on control plane machin...

[SECURITY] Fedora 41 Update: kubernetes1.32-1.32.6-1.fc41

Production-Grade Container Scheduling and Management. Installs kubelet, the kubernetes agent on each machine in a cluster. The kubernetes-client sub-package, containing kubectl, is recommended but not strictly required. The kubernetes-client sub-package should be installed on control plane machin...

[SECURITY] Fedora 40 Update: kubernetes-1.29.4-1.fc40

Open Source Production-Grade Container Scheduling And Management Platform Installs kubelet, the kubernetes agent on each machine in a cluster. The kubernetes-client sub-package, containing kubectl, is recommended but not strictly required. The kubernetes-client sub-package should be installed on...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

PT-2023-33015 · Unknown · Kubernetes Client

Name of the Vulnerable Software and Affected Versions: Kubernetes client versions prior to 3.5.0 Description: The issue allows sensitive data from Secret resources to be logged into the debug log when debug logging is enabled via the DEBUG environment variable. This could expose sensitive...

CVE-2021-4178

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

Code injection

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

Arbitrary Code Execution

io.fabric8:kubernetes-client is vulnerable to arbitrary code execution. Misconfigured YAML parsing in unmarshalYaml function allows local authenticated attackers to execute arbitrary code on the target machine via a maliciously crafted YAML string...

io.apicurio:apicurio-registry-tenant-manager-api (>=2.0.0.Final <=2.0.2.Final), io.dekorate:core-junit (>=2.0.0 <=2.4.1) +105 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (>=5.1.0 <=5.1.1)

io.fabric8:kubernetes-client MAVEN version =5.1.0, =2.0.0.Final, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.4.1 and more Source cves: CVE-2021-4178 Source advisory: OSV:GHSA-98G7-RXMF-RRXM...

com.dajudge.kindcontainer:kindcontainer (=0.0.15), io.automatiko.quarkus:automatiko-operator (=0.10.0) +93 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (=5.8.0)

io.fabric8:kubernetes-client MAVEN version =5.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.fabric8:kubernetes-client and may be impacted: - com.dajudge.kindcontainer:kindcontainer =0.0.15 - io.automatiko.quarkus:automatiko-operator =0.10.0 -...

com.apothesource.fam.kubeint.itest:com.apothesource.fam.kubeint.itest.gradle.plugin (>=0.0.1 <=0.4.3), com.apothesource.fam:kubeint-gradle-plugin (>=0.0.1 <=0.4.3) +153 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (>=5.2.0 <=5.3.1)

io.fabric8:kubernetes-client MAVEN version =5.2.0, =0.0.1, =0.0.1, =0.3.0, =0.4.0, =5.2.0, =5.3.0, =5.3.0, =5.3.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.3.1 and more Source cves: CVE-2021-4178 Source advisory: OSV:GHSA-98G7-RXMF-RRXM...

com.baidu.hugegraph:computer-k8s (>=0.1.0 <=0.1.3), com.baidu.hugegraph:computer-test (>=0.1.0 <=0.1.3) +152 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (>=5.5.0 <=5.7.3)

io.fabric8:kubernetes-client MAVEN version =5.5.0, =0.1.0, =0.1.0, =0.0.13, =2.12.0, =1.96.0, =0.6.0, =0.6.0, =2.5.0, =2.5.0, =2.5.0, =2.6.0 and more Source cves: CVE-2021-4178 Source advisory: OSV:GHSA-98G7-RXMF-RRXM...

cz.xtf:builder (=0.25), cz.xtf:core (=0.25) +51 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (>=5.11.0 <=5.11.1)

io.fabric8:kubernetes-client MAVEN version =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.0, =5.11.1 and more Source cves: CVE-2021-4178 Source advisory: OSV:GHSA-98G7-RXMF-RRXM...

com.lightbend.akka:kube-actions_2.12 (>=0.0.0-1-5c26b172 <=0.1.1), com.lightbend.akka:kube-actions_2.13 (>=0.0.0-1-5c26b172 <=0.1.1) +170 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (>=5.0.0-beta-1 <=5.0.2)

io.fabric8:kubernetes-client MAVEN version =5.0.0-beta-1, =0.0.0-1-5c26b172, =0.0.0-1-5c26b172, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504,...

GHSA-98G7-RXMF-RRXM fabric8 kubernetes-client vulnerable

fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing...

PT-2022-11483 · Unknown · Fabric 8 Kubernetes Client

Name of the Vulnerable Software and Affected Versions: Fabric 8 Kubernetes client versions 5.0.0-beta-1 and above Description: A flaw was found in the Fabric 8 Kubernetes client due to improperly configured YAML parsing, allowing a local and privileged attacker to supply malicious YAML, which can...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

A minor version update from 7.10 to 7.11 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...