CVE-2021-25743: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal

Low severity · published Jan 7, 2022

CVE-2021-25743

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal

3.0

CVSS

0.8%

EPSS

On KEV

Description

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Attack vector

Network

Complexity

High

Privileges

Low

User interaction

Required

Confidentiality

None

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kubernetes · Kubernetes

through 1.25.0; 1.26.0; 1.26.0; 1.26.0 · source: NVD

Affected product

Kubernetes

All Kubernetes CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-25743

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-25743

Vendor Advisory

https://github.com/kubernetes/kubernetes/issues/101695

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220217-0003/