Security issue in kubernetes-client

[jordyv]

Describe the bug

Hi team,

I think I found a security issue in the kubernetes-client library which can cause code execution depending on where the input is coming from. If a malicious config string or Kubernetes resource string is passed to a specific function in the library, this will execute arbitrary Java code on the machine which parses the resources.

I didn't found a proper way to report this instead of creating a GitHub issue. Should I add more details to this public issue or is there a way to report this privately?

Thanks in advance for your response.

Regards,
Jordy

Fabric8 Kubernetes Client version

5.10.1@latest

Steps to reproduce

N/A

Expected behavior

N/A

Runtime

Kubernetes (vanilla)

Kubernetes API Server version

1.22.3@latest

Environment

Windows, Linux, macOS

Fabric8 Kubernetes Client Logs

No response

Additional context

No response

[manusa]

Hi @jordyv
Please report to secalert@redhat.com

[manderson23]

@manusa was there a specific reason that there wasn't a 5.9.1 release with this fix?

[manusa]

It's a moderate issue https://access.redhat.com/security/cve/cve-2021-4178

We cut a release for those versions that might be a little bit more challenging to update to the next minor. Moving to 5.10.2 should be really smooth.

If possible, I'd recommend to bump your project to 5.12.1 (or latest 5.x release)

[mareknovotny]

not sure if this affects also 4.x versions? Can you confirm?

[manusa]

No, it only affects 5.x versions db1923b