CVE-2021-20218

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-16 · updated 2026-06-17
Weakness: CWE-22

Description

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

Affected products

RedHat A-Mq Online: all versions
Red Hat build of Quarkus: all versions
RedHat Codeready Studio: 12.0
RedHat Descision Manager: 7.0
RedHat Integration Camel K: all versions
RedHat Jboss Fuse: 7.0.0
RedHat Kubernetes-Client: from 4.2.0 before 4.7.2; from 4.8.0 before 4.11.2; from 4.12.0 before 4.13.2; from 5.0.0 before 5.0.2 — fixed in 4.11.2, 4.13.2, 4.7.2, 5.0.2
Red Hat OpenShift Container Platform 4.18: 3.11
RedHat Process Automation: 7.0

How to fix

Upgrade to a fixed version: RedHat Kubernetes-Client 4.11.2, 4.13.2, 4.7.2, 5.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20218 or the next vulnerability affects your stack