CVE-2021-25743
Description
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3 | 3 | 3 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | High | High |
| Privileges Required | Low | Low | Low |
| User Interaction | Required | Required | Required |
| Scope | Changed | Changed | Changed |
| Confidentiality | None | None | None |
| Integrity Impact | Low | Low | Low |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Red Hat CVSS v3 Score Explanation
A successful attack depends on conditions beyond the attacker's control (like how the target app or person will react to the crafted, spoofed events). Therefore the Attack Complexity (AC) metric has been set to High. An attacker must be able to use the target Kubernetes cluster and be able to upload crafted objects, therefore the Privileges Required (PR) metric has been set to Low.
Because this vulnerability may impact services or apps that use data from the attacker controlled cluster (such as monitoring applications) the Scope (S) metric is set to Changed.
This vulnerability does not have direct impact on the Confidentiality (C) of the data or the Availability (A) of the service, but can be used to hide events related to the other attack techniques. The direct impact is to the Integrity (I) of the data, but because the attacker does not have control over the consequence of a modification, the Integrity metric is set to Low.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
