CVE-2021-25743: ANSI escape characters not filtered

January 8, 2022 (updated September 8, 2022)

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

References

github.com/advisories/GHSA-f9jg-8p32-2f55
github.com/kubernetes/kubernetes/issues/101695
nvd.nist.gov/vuln/detail/CVE-2021-25743
security.netapp.com/advisory/ntap-20220217-0003/

Code Behaviors & Features

Detect and mitigate CVE-2021-25743 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →