p PatchFirst

CVE-2021-25743

CVE-2021-25743 · ANSI escape characters in kubectl output are not being filtered

This page contains facts from public vulnerability sources. Check the original advisory before updating.

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

CVSS 3.0 · Low · EPSS 0.8% · Public exploit · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • kubernetes

    Versions
    • ≥ unspecified, ≤ 1.23.1: Affected (custom)
    • ≥ next of 1.23.1, < unspecified: Unknown (custom)
    • ≥ unspecified, ≤ 1.22.5: Affected (custom)
    • ≥ next of 1.22.5, < unspecified: Unknown (custom)
    • ≥ unspecified, ≤ 1.21.8: Affected (custom)
    • ≥ next of 1.21.8, < unspecified: Unknown (custom)
    • ≥ unspecified, ≤ 1.20.14: Affected (custom)
    • ≥ next of 1.20.14, < unspecified: Unknown (custom)

    No fix published

  • kubernetes Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1.1

    Update to 1.20.5+really1.20.2-1.1

  • kubernetes Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.31.4+ds-1

    Update to 1.31.4+ds-1

  • kubernetes Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.31.4+ds-1

    Update to 1.31.4+ds-1

Original sources

Check your server →