CVE-2021-25743
Fixed in a distro release EPSS <1%CVSS 3.0
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.26.0-alpha.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-2.7 | 0 |
| Chainguard | argo-cd-2.7-compat | 0 |
| Chainguard | argo-cd-2.7-repo-server | 0 |
| Chainguard | argo-cd-2.8 | 0 |
| Chainguard | argo-cd-2.8-compat | 0 |
| Chainguard | argo-cd-2.8-repo-server | 0 |
| Chainguard | argo-cd-2.9 | 0 |
| Chainguard | argo-cd-2.9-compat | 0 |
| Chainguard | argo-cd-2.9-repo-server | 0 |
| Chainguard | argo-cd-fips-2.8 | 0 |
| Chainguard | argo-cd-fips-2.8-compat | 0 |
| Chainguard | argo-cd-fips-2.8-repo-server | 0 |
| Chainguard | argo-cd-fips-2.9 | 0 |
| Chainguard | argo-cd-fips-2.9-compat | 0 |
| Chainguard | argo-cd-fips-2.9-repo-server | 0 |
| Chainguard | aws-efs-csi-driver | 0 |
| Chainguard | aws-efs-csi-driver-fips | 2.1.14-r1 |
| Chainguard | cluster-autoscaler-1.25 | 0 |
| Chainguard | cluster-autoscaler-1.25-compat | 0 |
| Chainguard | kubectl-1.25 | no fix |
| Chainguard | kubectl-1.25-default | no fix |
| Chainguard | kubectl-bash-completion-1.25 | no fix |
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubernetes-dns-node-cache | 0 |
| Chainguard | kubernetes-dns-node-cache-1.17 | 0 |
| Chainguard | nodetaint | 0 |
| Chainguard | spark-operator | 0 |
| Chainguard | spark-operator-oci-entrypoint | 0 |
| Chainguard | sparkctl | 0 |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1.1 |
| Debian 13 | kubernetes | 1.31.4+ds-1 |
| Debian 14 | kubernetes | 1.31.4+ds-1 |
| SUSE Enterprise Storage 7.1 | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Enterprise Storage 7.1 | kubernetes1.24 | 1.24.17-150300.7.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | kubernetes1.24 | 1.24.17-150300.7.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | kubernetes1.24 | 1.24.17-150400.9.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | kubernetes1.24 | 1.24.17-150400.9.16.1 |
| SUSE Linux Enterprise Module for Containers 15 SP5 | kubernetes1.23 | 1.23.17-150500.3.15.1 |
| SUSE Linux Enterprise Module for Containers 15 SP5 | kubernetes1.24 | 1.24.17-150500.3.19.1 |
| SUSE Linux Enterprise Module for Containers 15 SP5 | kubernetes1.25 | 1.25.16-150400.9.10.1 |
| SUSE Linux Enterprise Module for Containers 15 SP6 | kubernetes1.25 | 1.25.16-150400.9.10.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | kubernetes1.24 | 1.24.17-150300.7.6.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | kubernetes1.24 | 1.24.17-150400.9.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | kubernetes1.24 | 1.24.17-150300.7.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | kubernetes1.23 | 1.23.17-150300.7.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | kubernetes1.24 | 1.24.17-150400.9.16.1 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | argo-cd-2.7 | 0 |
| Wolfi | argo-cd-2.7-compat | 0 |
| Wolfi | argo-cd-2.7-repo-server | 0 |
| Wolfi | argo-cd-2.8 | 0 |
| Wolfi | argo-cd-2.8-compat | 0 |
| Wolfi | argo-cd-2.8-repo-server | 0 |
| Wolfi | argo-cd-2.9 | 0 |
| Wolfi | argo-cd-2.9-compat | 0 |
| Wolfi | argo-cd-2.9-repo-server | 0 |
| Wolfi | aws-efs-csi-driver | 0 |
| Wolfi | cluster-autoscaler-1.25 | 0 |
| Wolfi | cluster-autoscaler-1.25-compat | 0 |
| Wolfi | kubectl-1.25 | no fix |
| Wolfi | kubectl-1.25-default | no fix |
| Wolfi | kubectl-bash-completion-1.25 | no fix |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| Wolfi | kubernetes-dns-node-cache | 0 |
| Wolfi | nodetaint | 0 |
| Wolfi | spark-operator | 0 |
| Wolfi | spark-operator-oci-entrypoint | 0 |
| Wolfi | sparkctl | 0 |
| openSUSE Leap 15.5 | kubernetes1.23 | 1.23.17-150500.3.15.1 |
| openSUSE Leap 15.5 | kubernetes1.24 | 1.24.17-150500.3.19.1 |
| openSUSE Leap 15.5 | kubernetes1.25 | 1.25.16-150400.9.10.1 |
| openSUSE Leap 15.6 | kubernetes1.23 | 1.23.17-150500.3.15.1 |
| openSUSE Leap 15.6 | kubernetes1.24 | 1.24.17-150500.3.19.1 |
| openSUSE Leap 15.6 | kubernetes1.25 | 1.25.16-150400.9.10.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |