{"answers":{"affected":"3 open source packages ship an affected version, including github.com/cilium/hubble.","exploited":"There is no known exploitation of CVE-2025-48056 in the wild and no public exploit code.","fix":"Upgrade github.com/cilium/hubble to 1.17.2 or later.","what":"CVE-2025-48056 is a medium-severity vulnerability in cilium hubble, published on 20 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-48056 and fix it if it is affected.\n\nWhat it is: CVE-2025-48056 is a medium-severity vulnerability in cilium hubble, published on 20 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-48056 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cilium/hubble (Go): affected all versions; fixed in 1.17.2\n- github.com/cilium/hubble (Go): affected all versions; fixed in 1.17.2\n- github.com/cilium/hubble (Go): affected all versions; fixed in 1.17.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-48056/ (Markdown: https://insights.sbomify.com/CVE-2025-48056/index.md)","id":"CVE-2025-48056","markdown":"https://insights.sbomify.com/CVE-2025-48056/index.md","name":"CVE-2025-48056","record":{"aliases":["GHSA-274q-79q9-52j7","GO-2025-3700","MINI-5x3m-g792-qq36","MINI-877v-gq6h-42c6"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_modify","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Hubble CLI","requires_auth":"none","summary":"Attackers can inject control characters into Hubble CLI output to hide logs or disrupt the terminal, requiring Layer 7 visibility monitoring.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"description":"Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output. This could be leveraged to conceal log entries, rewrite output, or even make the terminal temporarily unusable. Exploitation of this attack would require the victim to be monitoring Kafka traffic using Layer 7 Protocol Visibility at the time of the attack. The issue is patched in Hubble CLI v1.17.2. Hubble CLI users who are unable to upgrade can direct their Hubble flows to a log file and inspect the output within a text editor.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Hubble CLI vulnerable to character injection","id":"CVE-2025-48056","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"other","year":"2025"},"n_packages":3,"n_references":2,"next":{"headline":"Icinga 2 certificate renewal might incorrectly renew an invalid certificate","id":"CVE-2025-48057"},"packages":[{"ecosystem":"Go","fixed":["1.17.2"],"introduced":["0"],"last_affected":[],"package":"github.com/cilium/hubble","purl":null,"source":"GHSA-274q-79q9-52j7"},{"ecosystem":"Go","fixed":["1.17.2"],"introduced":["0"],"last_affected":[],"package":"github.com/cilium/hubble","purl":"pkg:golang/github.com/cilium/hubble","source":"GHSA-274q-79q9-52j7"},{"ecosystem":"Go","fixed":["1.17.2"],"introduced":["0"],"last_affected":[],"package":"github.com/cilium/hubble","purl":"pkg:golang/github.com/cilium/hubble","source":"GO-2025-3700"}],"prev":{"headline":"Combodo iTop has stored XSS in user portal's browse brick","id":"CVE-2025-48055"},"products":["hubble"],"published":"2025-05-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-05-20","vendors":["cilium"]},"summary":"Attackers can inject control characters into Hubble CLI output to hide logs or disrupt the terminal, requiring Layer 7 visibility monitoring.","url":"https://insights.sbomify.com/CVE-2025-48056/"}