Information disclosure in Helm - CVE-2019-25210
Published: April 3, 2024
Vulnerability identifier: #VU88099
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-25210
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application, which displays values of secrets when the --dry-run flag is used. A remote attacker can gain access to sensitive information.
Affected software
Helm
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenShift Container Platform
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenShift Container Platform
How to mitigate CVE-2019-25210
Follow vendor's workaround to resolve this issue.
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.3.6, 4.4.0
Red Hat OpenShift Container Platform - addressed in versions 4.16.0, 4.18.10
Red Hat OpenShift Container Platform - addressed in versions 4.16.0, 4.18.10
External References
Related Security Bulletins
- Information disclosure in Helm
- Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.3
- Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18