Skip to content
Fencer Vulns
high 7.4

CVE-2021-20218 json

Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

published 2021-03-16 5 y ago modified 2026-06-17 4 mo ago also GHSA-jwh2-ffg4-48xc , EUVD-2022-4447

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Patch / fix

  • maven io.fabric8:kubernetes-client 4.7.2, 4.11.2, 4.13.2, 5.0.2
  • redhat kubernetes-client 4.7.2, 4.11.2, 4.13.2, 5.0.2
  • cri-o openshift 4.7 1.20.2-4.rhaos4.7.gitd5a999a.el7
  • cri-o openshift 4.7 1.20.2-4.rhaos4.7.gitd5a999a.el8
  • jenkins-2-plugins openshift 4.7 4.7.1616671397-1.el8
  • openshift-clients openshift 4.7 4.7.0-202103251046.p0.git.3957.c4da68b.el7
  • openshift-clients openshift 4.7 4.7.0-202103251046.p0.git.3957.c4da68b.el8
  • openshift-clients-redistributable openshift 4.7 4.7.0-202103251046.p0.git.3957.c4da68b.el7
  • openshift-clients-redistributable openshift 4.7 4.7.0-202103251046.p0.git.3957.c4da68b.el8

red hat advisories RHSA-2021:1006

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20218 updated cvss 7.4

fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise

  • Red Hat Integration Camel K 1 kubernetes-client Red Hat Integration Camel Quarkus 1 kubernetes-client
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins, openshift3/ose-logging-elasticsearch5 Red Hat OpenShift Container Platform 4 openshift4/ose-logging-elasticsearch5
    affected: no fix planned “Will not fix”
  • Red Hat AMQ Online 1.7.0 GA
    fixed: vendor fix RHSA-2021:0986
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat Integration
    fixed: vendor fix RHSA-2021:3205
  • Red Hat Integration Camel Quarkus 2
    fixed: vendor fix RHSA-2021:3207
  • Red Hat OpenShift Container Platform 4.7 jenkins-2-plugins 4.7.1616671397-1.el8
    fixed: vendor fix RHSA-2021:1006
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.stream, openshift4/ose-coredns v4.8.0-202106291913.p0.git.642b46e.assembly.stream, +136 more
    fixed: vendor fix RHSA-2021:2438
show 4 more
  • Red Hat RHDM 7.12.0
    fixed: vendor fix RHSA-2022:0297
  • Red Hat RHPAM 7.12.0
    fixed: vendor fix RHSA-2022:0296
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2021:1004
  • Red Hat JBoss Fuse 6 kubernetes-client Red Hat OpenShift Container Platform 4.7 cri-o 1.20.2-4.rhaos4.7.gitd5a999a.el7, cri-o 1.20.2-4.rhaos4.7.gitd5a999a.el8, openshift-kuryr 4.7.0-202103241948.p0.git.2504.add19d0.el8, openshift-clients 4.7.0-202103251046.p0.git.3957.c4da68b.el7, openshift-clients 4.7.0-202103251046.p0.git.3957.c4da68b.el8, openshift-kuryr-cni 4.7.0-202103241948.p0.git.2504.add19d0.el8, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven io.fabric8:kubernetes-client
>=4.2.0, <4.7.2
>=4.8.0, <4.11.2
>=4.12.0, <4.13.2
>=5.0.0, <5.0.2
4.7.2
4.11.2
4.13.2
5.0.2

Affected products

  • n/a fabric8-kubernetes-client

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.