CVE-2019-25210

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25210
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/helm/helm/issues/7275 Issue Tracking
https://github.com/helm/helm/issues/7275 Issue Tracking
https://helm.sh/blog/response-cve-2019-25210/ Vendor Advisory
https://helm.sh/blog/response-cve-2019-25210/ Vendor Advisory
https://www.cncf.io/projects/helm/ Product
https://www.cncf.io/projects/helm/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:helm:helm:-:*:*:*:*:*:*:*
History

11 Feb 2025, 15:58

Type Values Removed Values Added
CPE cpe:2.3:a:helm:helm:-:*:*:*:*:*:*:*
First Time Helm
Helm helm
References () https://www.cncf.io/projects/helm/ - () https://www.cncf.io/projects/helm/ - Product
References () https://github.com/helm/helm/issues/7275 - () https://github.com/helm/helm/issues/7275 - Issue Tracking
References () https://helm.sh/blog/response-cve-2019-25210/ - () https://helm.sh/blog/response-cve-2019-25210/ - Vendor Advisory
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

15 Mar 2024, 01:15

Type Values Removed Values Added
Summary An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.
References
  • () https://helm.sh/blog/response-cve-2019-25210/ -

03 Mar 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-03 21:15

Updated : 2025-02-11 15:58

NVD link : CVE-2019-25210

Mitre link : CVE-2019-25210

JSON object : View

Products Affected

helm

  • helm
CWE
NVD-CWE-noinfo