CVE-2019-25210
mediumPriorität · verfolgen · 26EPSS 0.007 · 52. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6–9.1
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (66)
Betroffene Produkte und Versionsbereiche.
- Red Hat Ansible Automation Platformalle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:-
- Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
- Red Hat OpenShift API for Data Protection 1alle Versionencert_bundDEcpe:/a:redhat:openshift:api_for_data_protection_1
- Red Hat OpenShift Kube Descheduler Operator 5alle Versionencert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
- Red Hat OpenShift Run Once Duration Override Operator 1alle Versionencert_bundDEcpe:/a:redhat:openshift:run_once_duration_override_operator_1
- Red Hat OpenShift Secondary Scheduler Operatoralle Versionencert_bundDEcpe:/a:redhat:openshift:::secondary_scheduler_operator
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
- GHSA-jw44-4f3j-q396Withdrawn Advisory: Helm shows secrets in clear text2024-03-03ghsa · osvUS
### Withdrawn Advisory This advisory has been withdrawn because the issue describes intended behavior and the output is not exposed to unauthorized users. This link has been maintained to preserve external references. ### Original Description An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2019-25210/cnnvd
- https://github.com/helm/helm/issues/7275cnnvd
- https://helm.sh/blog/response-cve-2019-25210/cnnvd
- https://www.cncf.io/projects/helm/cnnvd
- https://github.com/helm/helm/issues/7275enisa_euvd
- https://helm.sh/blog/response-cve-2019-25210/enisa_euvd
- https://www.cncf.io/projects/helm/enisa_euvd
- https://github.com/helm/helm/issues/7275Issue Trackingnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan