Vulnerability · Published Jan 7, 2022 · Assigned by kubernetes
CVE-2021-25743ANSI escape characters in kubectl output are not being filtered
Low 3.0
In plain English
A low-severity security flaw in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.0Low
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kubernetes | 1.20.5+really1.20.2-1.1 | DEBIAN-CVE-2021-25743 |
| Debian:13 | kubernetes | 1.31.4+ds-1 | DEBIAN-CVE-2021-25743 |
| Debian:14 | kubernetes | 1.31.4+ds-1 | DEBIAN-CVE-2021-25743 |
| Go | k8s.io/kubernetes | 1.26.0-alpha.3 | GHSA-f9jg-8p32-2f55 |
| Go | k8s.io/kubernetes | 1.26.0-alpha.3 | GO-2022-0983 |
| Ubuntu:22.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2021-25743 |
| Ubuntu:24.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2021-25743 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | unspecified – through 1.23.1unspecified – through 1.22.5unspecified – through 1.21.8unspecified – through 1.20.14 |
Weakness: CWE-150 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
References
- https://github.com/kubernetes/kubernetes/issues/101695 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220217-0003/ x_refsource_CONFIRM