ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
02 / AFFECTED SOFTWARE
Affected packages
139 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
05 / REFERENCES
Further evidence
- https://github.com/advisories/GHSA-f9jg-8p32-2f55
- https://github.com/kubernetes/kubernetes/commit/dad0e937c0f76344363eb691b2668490ffef8537
- https://github.com/kubernetes/kubernetes/issues/101695
- https://github.com/kubernetes/kubernetes/pull/112553
- https://security.netapp.com/advisory/ntap-20220217-0003
- https://github.com/kubernetes/kubernetes
- https://nvd.nist.gov/vuln/detail/CVE-2021-25743
- https://security.netapp.com/advisory/ntap-20220217-0003/