CVE-2023-25165

Helm is a tool that streamlines installing and managing Kubernetes applications.getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with helm install|upgrade|template or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the getHostByName function is not being used in a template to disclose any information you do not want passed to DNS servers.

A Helm contributor discovered an information disclosure vulnerability using the getHostByName template function.

Impact

getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with helm install|upgrade|template or when the Helm SDK is used to render a chart.

Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.

Patches

The issue has been fixed in Helm 3.11.1.

Workarounds

Prior to using a chart with Helm verify the getHostByName function is not being used in a template to disclose any information you do not want passed to DNS servers.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Philipp Stehle at SAP.

Helm is a tool that streamlines installing and managing Kubernetes applications.getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with helm install|upgrade|template or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the getHostByName function is not being used in a template to disclose any information you do not want passed to DNS servers.

An information disclosure vulnerability exists in the getHostByName template function.

The function getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with "helm install|upgrade|template" or when the Helm SDK is used to render a chart.

Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.

This update for trivy fixes the following issues:

Update to version 0.37.3 (boo#1208091, CVE-2023-25165):

• chore(helm): update Trivy from v0.36.1 to v0.37.2 (#3574)
• ci: quote pros in c++ for semantic pr (#3605)
• fix(image): check proxy settings from env for remote images (#3604)

Update to version 0.37.2:

• BREAKING: use normalized trivy-java-db (#3583)
• fix(image): add timeout for remote images (#3582)
• fix(misconf): handle dot files better (#3550)

Update to version 0.37.1:

• fix(sbom): download the Java DB when generating SBOM (#3539)
• fix: use cgo free sqlite driver (#3521)
• ci: fix path to dist folder (#3527)

Update to version 0.37.0:

• fix(image): close layers (#3517)
• refactor: db client changed (#3515)
• feat(java): use trivy-java-db to get GAV (#3484)
• docs: add note about the limitation in Rekor (#3494)
• docs: aggregate targets (#3503)
• deps: updates wazero to 1.0.0-pre.8 (#3510)
• docs: add alma 9 and rocky 9 to supported os (#3513)
• chore: add missing target labels (#3504)
• docs: add java vulnerability page (#3429)
• feat(image): add support for Docker CIS Benchmark (#3496)
• feat(image): secret scanning on container image config (#3495)
• chore(deps): Upgrade defsec to v0.82.8 (#3488)
• feat(image): scan misconfigurations in image config (#3437)
• chore(helm): update Trivy from v0.30.4 to v0.36.1 (#3489)
• feat(k8s): add node info resource (#3482)
• perf(secret): optimize secret scanning memory usage (#3453)
• feat: support aliases in CLI flag, env and config (#3481)
• fix(k8s): migrate rbac k8s (#3459)
• feat(java): add implementationVendor and specificationVendor fields to detect GroupID from MANIFEST.MF (#3480)
• refactor: rename security-checks to scanners (#3467)
• chore: display the troubleshooting URL for the DB denial error (#3474)
• docs: yaml tabs to spaces, auto create namespace (#3469)
• docs: adding show-and-tell template to GH discussions (#3391)
• fix: Fix a temporary file leak in case of error (#3465)
• fix(test): sort cyclonedx components (#3468)
• docs: fixing spelling mistakes (#3462)
• ci: set paths triggering VM tests in PR (#3438)
• docs: typo in --skip-files (#3454)
• feat(custom-forward): Extended advisory data (#3444)
• docs: fix spelling error (#3436)
• refactor(image): extend image config analyzer (#3434)
• fix(nodejs): add ignore protocols to yarn parser (#3433)
• fix(db): check proxy settings when using insecure flag (#3435)
• feat(misconf): Fetch policies from OCI registry (#3015)
• ci: downgrade Go to 1.18 and use stable and oldstable go versions for unit tests (#3413)
• ci: store URLs to Github Releases in RPM repository (#3414)
• feat(server): add support of skip-db-update flag for hot db update (#3416)
• fix(image): handle wrong empty layer detection (#3375)
• test: fix integration tests for spdx and cycloneDX (#3412)
• feat(python): Include Conda packages in SBOMs (#3379)
• feat: add support pubspec.lock files for dart (#3344)
• fix(image): parsePlatform is failing with UNAUTHORIZED error (#3326)
• fix(license): change normalize for GPL-3+-WITH-BISON-EXCEPTION (#3405)
• feat(server): log errors on server side (#3397)
• docs: rewrite installation docs and general improvements (#3368)
• chore: update code owners (#3393)
• chore: test docs separately from code (#3392)
• docs: use the formula maintained by Homebrew (#3389)
• docs: add Security Management section with SonarQube plugin

Update to version 0.36.1:

• fix(deps): fix errors on yarn.lock files that contain local file reference (#3384)
• feat(flag): early fail when the format is invalid (#3370)
• docs(aws): fix broken links (#3374)

Update to version 0.36.0:

• docs: improve compliance docs (#3340)
• feat(deps): add yarn lock dependency tree (#3348)
• fix: compliance change id and title naming (#3349)
• feat: add support for mix.lock files for elixir language (#3328)
• feat: add k8s cis bench (#3315)
• test: disable SearchLocalStoreByNameOrDigest test for non-amd64 arch (#3322)
• revert: cache merged…

These are all security issues fixed in the helm-3.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helmfile-0.150.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nova-3.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the k9s-0.27.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the pluto-5.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.37.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cilium-cli-0.12.13-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the terraform-provider-helm-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for helm fixes the following issues:

Update to version 3.11.1 (bsc#1208084):

• CVE-2023-25165: Fixed a information disclosure problem via getHostByName injection inside a chart to get values to a malicious DNS server.

This update for terraform-provider-helm fixes the following issues:

Updated terraform-provider-helm to version 2.9.0:

• CVE-2023-25165: Fixed getHostByName Function Information Disclosure in helm embedded in the package (bsc#1208086).

This update for terraform-provider-helm fixes the following issues:

Updated terraform-provider-helm to version 2.9.0:

• CVE-2023-25165: Fixed getHostByName Function Information Disclosure by updating embedded helm package (bsc#1208086).