Riskcovery

CVE-2021-25743

ANSI escape characters in kubectl output are not being filtered

State
Published
Severity
3.0 Low
Published
Jan 7, 2022
Updated
Sep 16, 2024
Reserved
Jan 21, 2021

Read the record on cve.org

Description

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

Scores

CVSSScoreVectorSource
3.13.0 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:Nkubernetes

Weaknesses

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

Affected Products

ProductVersions
KubernetesKubernetes
  • 1.23.1 and earlierAffected
  • next of 1.23.1 to before unspecifiedUnknown
  • 1.22.5 and earlierAffected
  • next of 1.22.5 to before unspecifiedUnknown
  • 1.21.8 and earlierAffected
  • next of 1.21.8 to before unspecifiedUnknown
  • 1.20.14 and earlierAffected
  • next of 1.20.14 to before unspecifiedUnknown

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.