Bug 1827201 (CVE-2020-10721)
| Summary: | CVE-2020-10721 fabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, chazlett, drieden, ggaughan, gmalinko, janstey, jochrist, jwon, mnurisan, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jkube-1.0.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-10-20 20:21:14 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1821749 | ||
|
Description
Dhananjay Arunesh
2020-04-23 12:23:55 UTC
Acknowledgments: Name: Srikanth Ramu Statement: As this vulnerability is only present in community versions of the fabric8 maven plugin (4.0.0 and later) and has since been superseded by the Eclipse project JKube we would recommend any users of the fabric8-maven-plugin migrate to [JKube](https://www.eclipse.org/jkube/) there is a migration guide available [here](https://www.eclipse.org/jkube/docs/migration-guide/) to assist with this. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10721 |