Bug 830714 (CVE-2021-25743)

Summary:	<sys-cluster/kubectl-1.26.0: lacks escape/meta/control sequence filtering in terminal output
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/kubernetes/kubernetes/issues/101695
Whiteboard:	B3 [noglsa cleanup]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-01-07 04:30:55 UTC

CVE-2021-25743:

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

Comment 1 John Helmert III archtester

2022-10-15 19:32:13 UTC

There's a PR to fix: https://github.com/kubernetes/kubernetes/pull/112553

Comment 2 John Helmert III archtester

2022-10-30 17:10:51 UTC

Patch has landed: https://github.com/kubernetes/kubernetes/commit/dad0e937c0f76344363eb691b2668490ffef8537

Seems it will be in 1.26.

Comment 3 John Helmert III archtester

2023-11-05 16:56:15 UTC

Patch is in 1.26.0, and <1.26 branches aren't supported anymore according to https://kubernetes.io/releases/. Please cleanup.

No GLSA as it's not clear how exploitable/impactful this is.