CVE-2021-25743: kubernetes
CVSS: 3.0v3.1LowAnalyzed
AliasesSUSE-SU-2024:2858-1SUSE-SU-2024:2859-1SUSE-SU-2024:2928-1UBUNTU-CVE-2021-25743DEBIAN-CVE-2021-25743CGA-2368-mp66-wmf7CGA-24pf-mj47-8wx4CGA-2q4x-5x22-4894CGA-4qqm-7wrg-2qgmCGA-633c-m95r-26mgCGA-8jwj-fm88-42g6CGA-9jh4-rxrf-2pqjCGA-j822-287v-hvmpCGA-jgj6-cv43-cmhmCGA-jr9x-2hgf-9w56CGA-m5vg-3h4f-59q9CGA-m9p8-5f5p-pjwfCGA-qcpm-2wxj-p2x2CGA-qrj7-5h97-83vcCGA-r2r6-5gm8-m494CGA-vxm9-f2cx-c8g2GHSA-f9jg-8p32-2f55GO-2022-0983CGA-86vw-q2qg-76m6CGA-8w8j-gjw2-8rg9
Published 07-01-2022Last modified 16-09-2024
Vulnerability summary
CVE-2021-25743 is a low (CVSS 3.0) vulnerability in kubernetes. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.2% of scored vulnerabilities.
CVSS score
3.0/10
010
Low · v3.1 (CVE.org)EPSS score
0.78%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 20OPENSUSE-SU-2025:15424-1SUSE-SU-2024:3341-1SUSE-SU-2024:3343-1SUSE-SU-2025:02423-2CGA-344P-475P-56P2CGA-4889-FCH9-FH44CGA-53X7-GXMR-VC55CGA-5VJ3-6W7X-QWW5CGA-5VQJ-M5X2-GGRCCGA-85R8-9CH5-M8X6CGA-CH7Q-CCPW-HJW7CGA-F4MR-P4PG-J4XFCGA-FFCX-2Q2C-GF89CGA-FV69-JPMQ-6CC2CGA-G2XF-R675-CC5VCGA-GHXM-JJ53-FMQ2CGA-HFPV-MQVG-347WCGA-Q67V-9C4R-QW9XCGA-VR9M-25X5-6VFHCGA-W344-7QR4-66MR
Timeline
- 07-01-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
CVSS metrics
8 scores · 7 sources · 2 versionsLow 3.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
- OSV · GoEcosystem advisory · calculated3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
- NVDNIST3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Low 2.1Preferred score · NVD (NIST)
AV:N/AC:H/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.78% on 19-09-2026
19-09-202619-10-2026
EPSS score0.78%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard9 products
- aws-efs-csi-driverAll versions (No fix recorded)
- aws-efs-csi-driver-fips< 2.1.14-r1
- kubectl-1.25All versions (No fix recorded)
- kubectl-1.25-defaultAll versions (No fix recorded)
- kubectl-bash-completion-1.25All versions (No fix recorded)
Wolfi8 products
- aws-efs-csi-driverAll versions (No fix recorded)
- kubectl-1.25All versions (No fix recorded)
- kubectl-1.25-defaultAll versions (No fix recorded)
- kubectl-bash-completion-1.25All versions (No fix recorded)
- kubeflow-pipelinesAll versions (No fix recorded)
Opensuse6 products
- kubernetes1.23&distro=openSUSE Leap 15.5< 1.23.17-150500.3.15.1
- kubernetes1.23&distro=openSUSE Leap 15.6< 1.23.17-150500.3.15.1
- kubernetes1.24&distro=openSUSE Leap 15.5< 1.24.17-150500.3.19.1
- kubernetes1.24&distro=openSUSE Leap 15.6< 1.24.17-150500.3.19.1
- kubernetes1.25&distro=openSUSE Leap 15.5< 1.25.16-150400.9.10.1
Suse4 products
- kubernetes1.23&distro=SUSE Linux Enterprise Module for Containers 15 SP5< 1.23.17-150500.3.15.1
- kubernetes1.24&distro=SUSE Linux Enterprise Module for Containers 15 SP5< 1.24.17-150500.3.19.1
- kubernetes1.25&distro=SUSE Linux Enterprise Module for Containers 15 SP5< 1.25.16-150400.9.10.1
- kubernetes1.25&distro=SUSE Linux Enterprise Module for Containers 15 SP6< 1.25.16-150400.9.10.1
Debian1 product
- kubernetes< 1.20.5+really1.20.2-1.1 | < 1.31.4+ds-1
K8s.io1 product
- kubernetes< 1.26.0-alpha.3
Kubernetes1 product
- kubernetesEOL≥ unspecified, ≤ 1.23.1 | ≥ unspecified, ≤ 1.22.5 | ≥ unspecified, ≤ 1.21.8 | ≥ unspecified, ≤ 1.20.14 | ≤ 1.25.0 | 1.26.0:alpha0 | 1.26.0:alpha1 | 1.26.0:alpha2
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
8 vendors · 31 products
