CVE-2021-4178: 
Java vulnerability analysis and mitigation

A arbitrary code execution vulnerability (CVE-2021-4178) was discovered in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. The vulnerability was reported on December 16, 2021, and stems from an improperly configured YAML parsing implementation (GitHub Issue, CVE Mitre).

The vulnerability is related to insecure deserialization in the unmarshalYaml method due to the use of the SnakeYAML library. The flaw has been assigned a CVSS v3.1 base score of 6.7 (Moderate severity), with attack vector being Local, attack complexity Low, requiring High privileges, and no user interaction needed. The scope is Unchanged, with High impact on Confidentiality, Integrity, and Availability (GitHub Advisory).

If exploited, this vulnerability could allow a local and privileged attacker to execute arbitrary code on the affected system through the supply of malicious YAML configurations (Red Hat Bugzilla).

Multiple patched versions have been released to address this vulnerability: 5.0.3, 5.1.2, 5.3.2, 5.7.4, 5.8.1, 5.10.2, and 5.11.2. Users are advised to upgrade to these patched versions to mitigate the risk (GitHub Advisory).