[MAVEN:GHSA-W7GJ-H6F2-X4C6] fabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution

Severity High

Affected Packages 1

CVEs 1

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

The fabric8-maven-plugin has been superseded by the Eclipse project JKube and the recommendation is migrating users of the fabric8-maven-plugin to Eclipse Jkube >= 1.0.0

Package	Affected Version
pkg:maven/io.fabric8/fabric8-maven-plugin	>= 4.0.0-M1, <= 4.4.2

ID: MAVEN:GHSA-W7GJ-H6F2-X4C6
Severity: high
URL: https://github.com/advisories/GHSA-w7gj-h6f2-x4c6
Published: 2022-05-24T17:31:56
(2 years ago)
Modified: 2024-02-29T00:01:35
(6 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2020-10721
			https://bugzilla.redhat.com/show_bug.cgi?id=1827201
			https://github.com/advisories/GHSA-w7gj-h6f2-x4c6

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/io.fabric8/fabric8-maven-plugin	io.fabric8	fabric8-maven-plugin	>= 4.0.0-M1 <= 4.4.2

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date