# \[Kubernetes Java Client\] CVE-2021-25738: Code exec via yaml parsing

**URL:** <https://discuss.kubernetes.io/t/kubernetes-java-client-cve-2021-25738-code-exec-via-yaml-parsing/15932>\
**Category:** Announcements\
**Created:** [May 17, 2021, 4:39pm UTC](https://discuss.kubernetes.io/t/kubernetes-java-client-cve-2021-25738-code-exec-via-yaml-parsing/15932 "2021-05-17T16:39:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tallclair](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tallclair/32/3516_2.png) [@tallclair](https://discuss.kubernetes.io/u/tallclair)\
**Post date:** [May 17, 2021, 4:39pm UTC](https://discuss.kubernetes.io/t/kubernetes-java-client-cve-2021-25738-code-exec-via-yaml-parsing/15932/1 "2021-05-17T16:39:31Z")

</div>

Hello Kubernetes Community,

A security issue was discovered in the Kubernetes Java client library where loading specially-crafted yaml can lead to code execution.

This issue has been rated Medium ([CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)), and assigned CVE-2021-25738.

### Am I vulnerable?

If you process untrusted inputs with the [Kubernetes Java Client](https://github.com/kubernetes-client/java) you may be vulnerable to this issue.

#### Affected Versions- Kubernetes Java Client == v11.0.0

- Kubernetes Java Client \<= v10.0.1

- Kubernetes Java Client \<= v9.0.2

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by validating inputs to the client.

#### Fixed Versions- Kubernetes Java Client \>= v12.0.0

- Kubernetes Java Client \>= v11.0.1

### Detection

If you find evidence that this vulnerability has been exploited, please contact [security@kubernetes.io](mailto:security@kubernetes.io)

#### Additional Details

See the GitHub issue for more details: [https://github.com/kubernetes-client/java/issues/1698](https://github.com/kubernetes-client/java/issues/1698)

#### Acknowledgements

This vulnerability was reported by Jordy Versmissen through our [bug bounty](https://hackerone.com/kubernetes).

Thank You,

Tim Allclair on behalf of the Kubernetes Product Security Committee