Bug 2042418 (CVE-2021-25743)

Summary:	CVE-2021-25743 kubernetes: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abenaiss, admiller, adudiak, aos-bugs, bcoca, bdettelb, bmontgom, bradley.g.smith, caswilli, cmeyers, crarobin, davidn, dhalasz, eparis, fjansen, gblomqui, go-sig, gparvin, hello, jbrooks, jburrell, jcajka, jcammara, jchaloup, jhardy, jmadigan, jobarker, joelsmith, jokerman, jramanat, jwong, kaycoth, mabashia, maszulik, mfojtik, ngough, njean, notting, nstielau, osapryki, pahickey, pamccart, relrod, rfreiman, rpetrell, sdoran, smcdonal, spandura, sponnaga, stcannon, sthirugn, strigazi, tfister, tkuratom, vbatts, vkrizan, vkumar, vmugicag, xxia, zebob.m
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2056821, 2056822, 2042419, 2043563, 2043564, 2043565, 2043569, 2043570, 2043571, 2044401, 2044402, 2047712
Bug Blocks:	2042420

Description Guilherme de Almeida Suckevicz 2022-01-19 13:49:27 UTC

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

Reference:
https://github.com/kubernetes/kubernetes/issues/101695

Comment 1 Guilherme de Almeida Suckevicz 2022-01-19 13:49:50 UTC

Created kubernetes tracking bugs for this issue:

Affects: fedora-all [bug 2042419]

Comment 2 Przemyslaw Roguski 2022-01-21 14:17:20 UTC

Created golang-k8s-kubectl tracking bugs for this issue:

Affects: fedora-all [bug 2043563]


Created golang-k8s-kubernetes tracking bugs for this issue:

Affects: fedora-all [bug 2043564]


Created origin tracking bugs for this issue:

Affects: fedora-all [bug 2043565]

Comment 13 Brad Smith 2022-11-10 15:15:29 UTC

As an FYI, upstream merged a pull request (https://github.com/kubernetes/kubernetes/pull/112553 ) which provides a partial fix for this bug. Pull request merged 11 days ago (today is 2022.11.10). See comment https://github.com/kubernetes/kubernetes/pull/112553#pullrequestreview-1161103953 on partial nature of pull request.