Lucene search

K
githubGitHub Advisory DatabaseGHSA-JW44-4F3J-Q396
HistoryMar 03, 2024 - 9:31 p.m.

Helm shows secrets in clear text

2024-03-0321:31:25
CWE-200
GitHub Advisory Database
github.com
7
helm
secrets
clear text
security concern
backwards compatibility
--dry-run
ci/cd

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.8%

An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor’s position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).

CPENameOperatorVersion
helm.sh/helm/v3le3.14.2

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.8%