Fluid Attacks Database

Description

kubectl ANSI escape characters not filtered kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	k8s.io/kubernetes	>=0 <1.26.0-alpha.3	1.26.0-alpha.3
go	k8s.io/kubernetes/pkg/kubectl	>=0 <1.18.0	1.18.0
debian 11	kubernetes	=1.20.5+really1.20.2-1 \|\| =1.20.5+really1.20.2-1.1 \|\| =1.31.4+ds-1 \|\| =1.31.4+ds-2 \|\| =1.32.3+ds-1 \|\| =1.32.3+ds-2 \|\| =1.33.4+ds-1	-
debian 13	kubernetes	>=0 <1.31.4+ds-1	1.31.4+ds-1
debian 12	kubernetes	>=0 <1.20.5+really1.20.2-1.1	1.20.5+really1.20.2-1.1
debian 14	kubernetes	>=0 <1.31.4+ds-1	1.31.4+ds-1

Aliases

1. CVE-2021-257432. NVD-2021-257433. OSV-2021-257434. OSV-DEBIAN-2021-257435. GHSA-f9jg-8p32-2f556. GCVE-2021-257437. SECURITY-TRACKER-CVE-2021-25743

References

1. https://github.com/kubernetes/kubernetes/issues/1016952. https://github.com/kubernetes/kubernetes/pull/1125533. https://github.com/kubernetes/kubernetes/commit/dad0e937c0f76344363eb691b2668490ffef85374. https://security.netapp.com/advisory/ntap-20220217-00035. https://security.netapp.com/advisory/ntap-20220217-0003/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.