GHSA-274q-79q9-52j7

Source

https://github.com/advisories/GHSA-274q-79q9-52j7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-274q-79q9-52j7/GHSA-274q-79q9-52j7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-274q-79q9-52j7

Aliases

CVE-2025-48056
GO-2025-3700

Published

2025-05-21T17:16:19Z

Modified

2025-05-23T16:13:20.519252Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Character injection in Hubble CLI

Details

Impact

A network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output. This could be leveraged to conceal log entries, rewrite output, or even make the terminal temporarily unusable. Exploitation of this attack would require the victim to be monitoring Kafka traffic using Layer 7 Protocol Visibility at the time of the attack.

Patches

This issue affects all versions of Hubble CLI before v1.17.2. The issue is patched in Hubble CLI v1.17.2, via https://github.com/cilium/cilium/pull/37401.

Workarounds

Hubble CLI users who are unable to upgrade can direct their Hubble flows to a log file and inspect the output within a text editor.

Acknowledgements

The Cilium community has worked together with members of Isovalent and the Cisco ASIG team to prepare these mitigations. Special thanks to @bipierce-cisco and @kokelley-cisco for reporting the issue and to @devodev for the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

Database specific

{
    "nvd_published_at": "2025-05-20T20:15:42Z",
    "cwe_ids": [
        "CWE-74"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-21T17:16:19Z"
}

References

Affected packages

Go / github.com/cilium/hubble

Package

Name: github.com/cilium/hubble; View open source insights on deps.dev
Purl: pkg:golang/github.com/cilium/hubble

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.17.2