CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2021-25738 – Code exec via yaml parsing
https://notcve.org/view.php?id=CVE-2021-25738
11 Oct 2021 — Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution. Una carga de yaml especialmente diseñado con la librería Kubernetes Java Client puede conllevar a una ejecución de código • http://www.openwall.com/lists/oss-security/2022/08/23/2 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8570 – Kubernetes Java client libraries unvalidated path traversal in Copy implementation
https://notcve.org/view.php?id=CVE-2020-8570
21 Jan 2021 — Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code. Las bibliotecas del cliente de Kubernetes Java en la versión 10.0.0 y las versiones anteriores a 9.0.1, permiten la escritura en rutas fuera del directorio actual cuando copia varios archivos ... • https://github.com/kubernetes-client/java/issues/1491 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •