CVE-2021-25743: ANSI escape characters in kubectl output are not being filtered
kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Other sources
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-25743?
CVE-2021-25743 is a vulnerability in kubectl, where it does not neutralize escape, meta, or control sequences contained in the raw data it outputs to a terminal.
What is the severity of CVE-2021-25743?
CVE-2021-25743 has a severity level of low.
Which software versions are affected by CVE-2021-25743?
Versions up to and including 1.26.0-alpha.3 of k8s.io/kubernetes and versions up to and including 1.18.0 of Kubernetes are affected by CVE-2021-25743.
How can I fix CVE-2021-25743?
To fix CVE-2021-25743, update to version 1.26.0-alpha.3 of k8s.io/kubernetes or a later version, or update to a version of Kubernetes above 1.18.0.
Where can I find more information about CVE-2021-25743?
You can find more information about CVE-2021-25743 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-25743), [GitHub](https://github.com/kubernetes/kubernetes/issues/101695), [NetApp Security Advisory](https://security.netapp.com/advisory/ntap-20220217-0003/).