{"id":"CVE-2023-25165","aliases":["AZL-13300","AZL-13558","BIT-helm-2023-25165","EUVD-2023-0766","GHSA-pwcw-6f5g-gxf8","GO-2023-1547","SUSE-SU-2023:1571-1","SUSE-SU-2023:1752-1","SUSE-SU-2023:2100-1","openSUSE-SU-2023:0064-1","openSUSE-SU-2024:12667-1","openSUSE-SU-2024:12668-1","openSUSE-SU-2024:12676-1","openSUSE-SU-2024:12682-1","openSUSE-SU-2024:12683-1","openSUSE-SU-2024:12692-1","openSUSE-SU-2024:12695-1","openSUSE-SU-2024:12729-1","openSUSE-SU-2025:15779-1"],"status":"published","title":"getHostByName Function Information Disclosure","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00768,"percentile":0.56015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-02-08T19:07:14Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Go","package":"helm.sh/helm/v3","fixed_in":["3.11.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"cert-manager","fixed_in":["1.7.3-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"helm","fixed_in":["3.10.3-3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"helm","fixed_in":["3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm","fixed_in":["3.11.1-150000.1.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"helm","fixed_in":["3.11.1-150000.1.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"helm","fixed_in":["3.11.1-150000.1.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-helm","fixed_in":["2.9.0-150200.6.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"terraform-provider-helm","fixed_in":["2.9.0-150200.6.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","fixed_in":["2.9.0-150200.6.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"terraform-provider-helm","fixed_in":["2.9.0-150200.6.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"terraform-provider-helm","fixed_in":["2.9.0-150100.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"trivy","fixed_in":["0.37.3-bp154.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"trivy","fixed_in":["0.37.3-bp154.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["3.11.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helmfile","fixed_in":["0.150.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nova","fixed_in":["3.6.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"k9s","fixed_in":["0.27.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pluto","fixed_in":["5.13.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trivy","fixed_in":["0.37.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cilium-cli","fixed_in":["0.12.13-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"terraform-provider-helm","fixed_in":["2.9.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.11.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"helm","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.11.1"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.11.1"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.1-150000.1.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.1-150000.1.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.1-150000.1.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150100.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.3-bp154.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.3-bp154.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helmfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.150.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"k9s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pluto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cilium-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.13-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.2-1.1"}]}],"bundled":20}],"products":[{"vendor":"helm","product":"helm"}],"references":[{"url":"https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25165","tags":["web","advisory"]},{"url":"https://github.com/helm/helm/commit/293b50c65d4d56187cd4e2f390f0ada46b4c4737","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1547","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pwcw-6f5g-gxf8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25165.json","tags":["advisory"]},{"url":"https://github.com/helm/helm","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231571-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25165","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231752-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208086","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232100-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZC5NXZSDG2FYOHGXMQE4LMFVABIGBY3E/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208091","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-25165","title":"getHostByName Function Information Disclosure","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2023-02-08T19:07:14.089Z","modified":"2025-03-10T21:15:03.873Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-0766","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2023-02-08T19:07:14Z","modified":"2025-03-10T21:15:03Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-pwcw-6f5g-gxf8","title":"Helm vulnerable to information disclosure via getHostByName Function ","description":"A Helm contributor discovered an information disclosure vulnerability using the `getHostByName` template function.\n\n### Impact\n\n`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart.\n\nInformation passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server.\n\n### Patches\n\nThe issue has been fixed in Helm 3.11.1.\n\n### Workarounds\n\nPrior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.\n\n### For more information\n\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\n\nDisclosed by Philipp Stehle at SAP.","status":"published","published":"2023-02-08T22:36:51Z","modified":"2023-02-14T19:26:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2023-25165","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2023-02-08T20:15:24.937Z","modified":"2026-06-17T05:40:49.253Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"AZL-13300","title":"CVE-2023-25165 affecting package cert-manager for versions less than 1.7.3-8","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2023-02-08T20:15:24Z","modified":"2026-04-21T04:22:47.760881Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-13558","title":"CVE-2023-25165 affecting package helm for versions less than 3.10.3-3","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2023-02-08T20:15:24Z","modified":"2026-04-21T04:22:52.361799Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2023-25165","title":"getHostByName Function Information Disclosure","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2023-02-08T19:07:14.089Z","modified":"2026-10-28T02:31:14.526044596Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-pwcw-6f5g-gxf8","title":"Helm vulnerable to information disclosure via getHostByName Function ","description":"A Helm contributor discovered an information disclosure vulnerability using the `getHostByName` template function.\n\n### Impact\n\n`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart.\n\nInformation passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server.\n\n### Patches\n\nThe issue has been fixed in Helm 3.11.1.\n\n### Workarounds\n\nPrior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.\n\n### For more information\n\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\n\nDisclosed by Philipp Stehle at SAP.","status":"published","published":"2023-02-08T22:36:51Z","modified":"2026-09-10T03:50:07.877081483Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"BIT-helm-2023-25165","title":"getHostByName Function Information Disclosure","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","status":"published","published":"2024-03-06T10:53:11.303Z","modified":"2026-09-08T08:48:22.996035709Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2023-1547","title":"Information disclosure in helm.sh/helm/v3","description":"An information disclosure vulnerability exists in the getHostByName template function.\n\nThe function getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with \"helm install|upgrade|template\" or when the Helm SDK is used to render a chart.\n\nInformation passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.","status":"published","published":"2023-02-14T15:53:55Z","modified":"2026-02-04T04:24:25.402649Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2023:0064-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.37.3 (boo#1208091, CVE-2023-25165):\n\n* chore(helm): update Trivy from v0.36.1 to v0.37.2 (#3574)\n* ci: quote pros in c++ for semantic pr (#3605)\n* fix(image): check proxy settings from env for remote images (#3604)\n\nUpdate to version 0.37.2:\n\n* BREAKING: use normalized trivy-java-db (#3583)\n* fix(image): add timeout for remote images (#3582)\n* fix(misconf): handle dot files better (#3550)\n\nUpdate to version 0.37.1:\n\n* fix(sbom): download the Java DB when generating SBOM (#3539)\n* fix: use cgo free sqlite driver (#3521)\n* ci: fix path to dist folder (#3527)\n\nUpdate to version 0.37.0:\n\n* fix(image): close layers (#3517)\n* refactor: db client changed (#3515)\n* feat(java): use trivy-java-db to get GAV (#3484)\n* docs: add note about the limitation in Rekor (#3494)\n* docs: aggregate targets (#3503)\n* deps: updates wazero to 1.0.0-pre.8 (#3510)\n* docs: add alma 9 and rocky 9 to supported os (#3513)\n* chore: add missing target labels (#3504)\n* docs: add java vulnerability page (#3429)\n* feat(image): add support for Docker CIS Benchmark (#3496)\n* feat(image): secret scanning on container image config (#3495)\n* chore(deps): Upgrade defsec to v0.82.8 (#3488)\n* feat(image): scan misconfigurations in image config (#3437)\n* chore(helm): update Trivy from v0.30.4 to v0.36.1 (#3489)\n* feat(k8s): add node info resource (#3482)\n* perf(secret): optimize secret scanning memory usage (#3453)\n* feat: support aliases in CLI flag, env and config (#3481)\n* fix(k8s): migrate rbac k8s (#3459)\n* feat(java): add implementationVendor and specificationVendor fields to detect GroupID from MANIFEST.MF (#3480)\n* refactor: rename security-checks to scanners (#3467)\n* chore: display the troubleshooting URL for the DB denial error (#3474)\n* docs: yaml tabs to spaces, auto create namespace (#3469)\n* docs: adding show-and-tell template to GH discussions (#3391)\n* fix: Fix a temporary file leak in case of error (#3465)\n* fix(test): sort cyclonedx components (#3468)\n* docs: fixing spelling mistakes (#3462)\n* ci: set paths triggering VM tests in PR (#3438)\n* docs: typo in --skip-files (#3454)\n* feat(custom-forward): Extended advisory data (#3444)\n* docs: fix spelling error (#3436)\n* refactor(image): extend image config analyzer (#3434)\n* fix(nodejs): add ignore protocols to yarn parser (#3433)\n* fix(db): check proxy settings when using insecure flag (#3435)\n* feat(misconf): Fetch policies from OCI registry (#3015)\n* ci: downgrade Go to 1.18 and use stable and oldstable go versions for unit tests (#3413)\n* ci: store URLs to Github Releases in RPM repository (#3414)\n* feat(server): add support of `skip-db-update` flag for hot db update (#3416)\n* fix(image): handle wrong empty layer detection (#3375)\n* test: fix integration tests for spdx and cycloneDX (#3412)\n* feat(python): Include Conda packages in SBOMs (#3379)\n* feat: add support pubspec.lock files for dart (#3344)\n* fix(image): parsePlatform is failing with UNAUTHORIZED error (#3326)\n* fix(license): change normalize for GPL-3+-WITH-BISON-EXCEPTION (#3405)\n* feat(server): log errors on server side (#3397)\n* docs: rewrite installation docs and general improvements (#3368)\n* chore: update code owners (#3393)\n* chore: test docs separately from code (#3392)\n* docs: use the formula maintained by Homebrew (#3389)\n* docs: add `Security Management` section with SonarQube plugin\n\nUpdate to version 0.36.1:\n\n* fix(deps): fix errors on yarn.lock files that contain local file reference (#3384)\n* feat(flag): early fail when the format is invalid (#3370)\n* docs(aws): fix broken links (#3374)\n\nUpdate to version 0.36.0:\n\n* docs: improve compliance docs (#3340)\n* feat(deps): add yarn lock dependency tree (#3348)\n* fix: compliance change id and title naming (#3349)\n* feat: add support for mix.lock files for elixir language (#3328)\n* feat: add k8s cis bench (#3315)\n* test: disable SearchLocalStoreByNameOrDigest test for non-amd64 arch (#3322)\n* revert: cache merged layers (#3334)\n* feat(cyclonedx): add recommendation (#3336)\n* feat(ubuntu): added support ubuntu ESM versions (#1893)\n* fix: change logic to build relative paths for skip-dirs and skip-files (#3331)\n* feat: Adding support for Windows testing (#3037)\n* feat: add support for Alpine 3.17 (#3319)\n* docs: change PodFile.lock to Podfile.lock (#3318)\n* fix(sbom): support for the detection of old CycloneDX predicate type (#3316)\n* feat(secret): Use .trivyignore for filtering secret scanning result (#3312)\n* chore(go): remove experimental FS API usage in Wasm (#3299)\n* ci: add workflow to add issues to roadmap project (#3292)\n* fix(vuln): include duplicate vulnerabilities with different package paths in the final report (#3275)\n* feat(sbom): better support for third-party SBOMs (#3262)\n* docs: add information about languages with support for dependency locations (#3306)\n* feat(vm): add `region` option to vm scan to be able to scan any region's ami and ebs snapshots (#3284)\n* fix(vuln): change severity vendor priority for ghsa-ids and vulns from govuln (#3255)\n* docs: remove comparisons (#3289)\n* feat: add support for Wolfi Linux (#3215)\n* ci: add go.mod to canary workflow (#3288)\n* feat(python): skip dev dependencies (#3282)\n* chore: update ubuntu version for Github action runnners (#3257)\n* fix(go): skip dep without Path for go-binaries (#3254)\n* feat(rust): add ID for cargo pgks (#3256)\n* feat: add support for swift cocoapods lock files (#2956)\n* fix(sbom): use proper constants (#3286)\n* test(vm): import relevant analyzers (#3285)\n* feat: support scan remote repository (#3131)\n* docs: fix typo in fluxcd (#3268)\n* docs: fix broken 'ecosystem' link in readme (#3280)\n* feat(misconf): Add compliance check support (#3130)\n* docs: Adding Concourse resource for trivy (#3224)\n* chore(deps): change golang from 1.19.2 to 1.19 (#3249)\n* fix(sbom): duplicate dependson (#3261)\n* chore(go): updates wazero to 1.0.0-pre.4 (#3242)\n* feat(report): add dependency locations to sarif format (#3210)\n* fix(rpm): add rocky to osVendors (#3241)\n* docs: fix a typo (#3236)\n* feat(dotnet): add dependency parsing for nuget lock files (#3222)\n* docs: add pre-commit hook to community tools (#3203)\n* feat(helm): pass arbitrary env vars to trivy (#3208)\n\nUpdate to version 0.35.0:\n\n* chore(vm): update xfs filesystem parser for change log (#3230)\n* feat: add virtual machine scan command (#2910)\n* docs: reorganize index and readme (#3026)\n* fix: `slowSizeThreshold` should be less than `defaultSizeThreshold` (#3225)\n* feat: Export functions for trivy plugin (#3204)\n* feat(image): add support wildcard for platform os (#3196)\n* fix: load compliance report from file system (#3161)\n* fix(suse): use package name to get advisories (#3199)\n* docs(image): space issues during image scan (#3190)\n* feat(containerd): scan image by digest (#3075)\n* fix(vuln): add package name to title (#3183)\n* fix: present control status instead of compliance percentage in compliance report (#3181)\n* perf(license): remove go-enry/go-license-detector. (#3187)\n* fix: workdir command as empty layer (#3087)\n* docs: reorganize ecosystem section (#3025)\n* feat(dotnet): add support dependency location for dotnet-core files (#3095)\n* feat(dotnet): add support dependency location for nuget lock files (#3032)\n* chore: update code owners for misconfigurations (#3176)\n* feat: add slow mode (#3084)\n* docs: fix typo in enable-builin-rules mentions (#3118)\n* feat: Add maintainer field to OS packages (#3149)\n* docs: fix some typo (#3171)\n* docs: fix links on Built-in Policies page (#3124)\n* fix: Perform filepath.Clean first and then filepath.ToSlash for skipFile/skipDirs settings (#3144)\n* chore: use newline for semantic pr (#3172)\n* fix(spdx): rename describes field in spdx (#3102)\n* chore: handle GOPATH with several paths in make file (#3092)\n* docs(flag): add 'rego' configuration file options (#3165)\n* chore(go): updates wazero to 1.0.0-pre.3 (#3090)\n* docs(license): fix typo inside quick start (#3134)\n* chore: update codeowners for docs (#3135)\n* fix(cli): exclude --compliance flag from non supported sub-commands (#3158)\n* fix: remove --security-checks none from image help (#3156)\n* fix: compliance flag description (#3160)\n* docs(k8s): fix a typo (#3163)\n\nUpdate to version 0.34.0:\n\n* feat(vuln): support dependency graph for RHEL/CentOS (#3094)\n* feat(vuln): support dependency graph for dpkg and apk (#3093)\n* perf(license): enable license classifier only with '--license-full' (#3086)\n* feat(report): add secret scanning to ASFF template (#2860)\n* feat: Allow override of containerd namespace (#3060)\n* fix(vuln): In alpine use Name as SrcName (#3079)\n* fix(secret): Alibaba AccessKey ID (#3083)\n\nUpdate to version 0.33.0:\n\n* refactor(k8s): custom reports (#3076)\n* fix(misconf): Bump in-toto-golang with correct CycloneDX predicate (#3068)\n* feat(image): add support for passing architecture and OS (#3012)\n* test: disable containerd integration tests for non-amd64 arch (#3073)\n* feat(server): Add support for client/server mode to rootfs command (#3021)\n* feat(vuln): support non-packaged binaries (#3019)\n* feat: compliance reports (#2951)\n* fix(flag): disable flag parsing for each plugin command (#3074)\n* feat(nodejs): add support dependency location for yarn.lock files (#3016)\n* chore: Switch github.com/liamg dependencies to github.com/aquasecurity (#3069)\n* feat: add k8s components (#2589)\n* fix(secret): update the regex for secrets scanning (#2964)\n* fix: bump trivy-kubernetes (#3064)\n* docs: fix missing 'image' subcommand (#3051)\n* chore: Patch golang x/text vulnerability (#3046)\n* chore: add licensed project logo (#3058)\n* feat(ubuntu): set Ubuntu 22.10 EOL (#3054)\n* refactor(analyzer): use strings.TrimSuffix instead of strings.HasSuffix (#3028)\n* feat(report): Use understandable value for shortDescription in SARIF reports (#3009)\n* docs(misconf): fix typo (#3043)\n* feat: add support for scanning azure ARM (#3011)\n* feat(report): add location.message to SARIF output (#3002) (#3003)\n* feat(nodejs): add dependency line numbers for npm lock files (#2932)\n* test(fs): add `--skip-files`, `--skip-dirs` (#2984)\n* docs: add Woodpecker CI integrations example (#2823)\n* fix(sbom): ref generation if serialNumber is empty when input is cyclonedx file (#3000)\n* fix(java): don't stop parsing jar file when wrong inner jar is found (#2989)\n* fix(sbom): use nuget purl type for dotnet-core (#2990)\n* perf: retrieve rekor entries in bulk (#2987)\n* feat(aws): Custom rego policies for AWS scanning (#2994)\n* docs: jq cli formatting (#2881)\n* docs(repo): troubleshooting $TMPDIR customization (#2985)\n* chore: run `go fmt` (#2897)\n* chore(go): updates wazero to 1.0.0-pre.2 (#2955)\n* fix(aws): Less function for slice sorting always returns false #2967\n* fix(java): fix unmarshal pom exclusions (#2936)\n\nUpdate to version 0.32.1:\n\n* fix(java): use fields of dependency from dependencyManagement from upper pom.xml to parse deps (#2943)\n* chore: expat lib and go binary deps vulns (#2940)\n* wasm: Removes accidentally exported memory (#2950)\n* fix(sbom): fix package name separation for gradle (#2906)\n* docs(readme.md): fix broken integrations link (#2931)\n* fix(image): handle images with single layer in rescan mergedLayers cache (#2927)\n* fix(cli): split env values with ',' for slice flags (#2926)\n* fix(cli): config/helm: also take into account files with `.yml` (#2928)\n* fix(flag): add file-patterns flag for config subcommand (#2925)\n\nUpdate to version 0.32.0:\n\n* docs: add Rekor SBOM attestation scanning (#2893)\n* chore: narrow the owner scope (#2894)\n* fix: remove a patch number from the recommendation link (#2891)\n* fix: enable parsing of UUID-only rekor entry ID (#2887)\n* docs(sbom): add SPDX scanning (#2885)\n* docs: restructure docs and add tutorials (#2883)\n* feat(sbom): scan sbom attestation in the rekor record (#2699)\n* feat(k8s): support outdated-api (#2877)\n* fix(c): support revisions in Conan parser (#2878)\n* feat: dynamic links support for scan results (#2838)\n* docs: update archlinux commands (#2876)\n* feat(secret): add line from dockerfile where secret was added to secret result (#2780)\n* feat(sbom): Add unmarshal for spdx (#2868)\n* fix: revert asff arn and add documentation (#2852)\n* docs: batch-import-findings limit (#2851)\n* feat(sbom): Add marshal for spdx (#2867)\n* build: checkout before setting up Go (#2873)\n* docs: azure doc and trivy (#2869)\n* fix: Scan tarr'd dependencies (#2857)\n* chore(helm): helm test with ingress (#2630)\n* feat(report): add secrets to sarif format (#2820)\n* refactor: add a new interface for initializing analyzers (#2835)\n* fix: update ProductArn with account id (#2782)\n* feat(helm): make cache TTL configurable (#2798)\n* build(): Sign releaser artifacts, not only container manifests (#2789)\n* chore: improve doc about azure devops (#2795)\n* docs: don't push patch versions (#2824)\n* feat: add support for conan.lock file (#2779)\n* feat: cache merged layers\n* feat: add support for gradle.lockfile (#2759)\n* feat: move file patterns to a global level to be able to use it on any analyzer (#2539)\n* Fix url validaton failures (#2783)\n* fix(image): add logic to detect empty layers (#2790)\n* feat(rust): add dependency graph from Rust binaries (#2771)\n\nUpdate to version 0.31.3:\n\n* fix: handle empty OS family (#2768)\n* fix: fix k8s summary report (#2777)\n* fix: don't skip packages that don't contain vulns, when using --list-all-pkgs flag (#2767)\n* chore: bump trivy-kubernetes (#2770)\n* fix(secret): Consider secrets in rpc calls (#2753)\n* fix(java): check depManagement from upper pom's (#2747)\n* fix(php): skip `composer.lock` inside `vendor` folder (#2718)\n* fix: fix k8s rbac filter (#2765)\n* feat(misconf): skipping misconfigurations by AVD ID (#2743)\n* chore(deps): Upgrade Alpine to 3.16.2 to fix zlib issue (#2741)\n* docs: add MacPorts install instructions (#2727)\n* docs: typo (#2730)\n\nUpdate to version 0.31.2:\n\n* fix: Correctly handle recoverable AWS scanning errors (#2726)\n* docs: Remove reference to SecurityAudit policy for AWS scanning (#2721)\n\nUpdate to version 0.31.1:\n\n* fix: upgrade defsec to v0.71.7 for elb scan panic (#2720)\n\nUpdate to version 0.31.0:\n\n* fix(flag): add error when there are no supported security checks (#2713)\n* fix(vuln): continue scanning when no vuln found in the first application (#2712)\n* revert: add new classes for vulnerabilities (#2701)\n* feat(secret): detect secrets removed or overwritten in upper layer (#2611)\n* fix(cli): secret scanning perf link fix (#2607)\n* chore(deps): bump github.com/spf13/viper from 1.8.1 to 1.12.0 (#2650)\n* feat: Add AWS Cloud scanning (#2493)\n* docs: specify the type when verifying an attestation (#2697)\n* docs(sbom): improve SBOM docs by adding a description for scanning SBOM attestation (#2690)\n* fix(rpc): scanResponse rpc conversion for custom resources (#2692)\n* feat(rust): Add support for cargo-auditable (#2675)\n* feat: Support passing value overrides for configuration checks (#2679)\n* feat(sbom): add support for scanning a sbom attestation (#2652)\n* chore(image): skip symlinks and hardlinks from tar scan (#2634)\n* fix(report): Update junit.tpl (#2677)\n* fix(cyclonedx): add nil check to metadata.component (#2673)\n* docs(secret): fix missing and broken links (#2674)\n* refactor(cyclonedx): implement json.Unmarshaler (#2662)\n* feat(kubernetes): add option to specify kubeconfig file path (#2576)\n* docs:  follow Debian's 'instructions to connect to a third-party repository' (#2511)\n* feat(alma): set AlmaLinux 9 EOL (#2653)\n* fix(misconf): Allow quotes in Dockerfile WORKDIR when detecting relative dirs (#2636)\n* test(misconf): add tests for misconf handler for dockerfiles (#2621)\n* feat(oracle): set Oracle Linux 9 EOL (#2635)\n* BREAKING: add new classes for vulnerabilities (#2541)\n* fix(secret): add newline escaping for asymmetric private key (#2532)\n* docs: improve formatting (#2572)\n* feat(helm): allows users to define an existing secret for tokens (#2587)\n* docs(mariner): use tdnf in fs usage example (#2616)\n* docs: remove unnecessary double quotation marks (#2609)\n* fix: Fix --file-patterns flag (#2625)\n* feat(report): add support for Cosign vulnerability attestation (#2567)\n* docs(mariner): use v2.0 in examples (#2602)\n* feat(report): add secrets template for codequality report (#2461)\n","status":"published","published":"2023-03-05T19:03:40Z","modified":"2026-02-04T03:02:50.304481Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12667-1","title":"helm-3.11.1-1.1 on GA media","description":"These are all security issues fixed in the helm-3.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:49.559293Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12668-1","title":"helmfile-0.150.0-2.1 on GA media","description":"These are all security issues fixed in the helmfile-0.150.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:11:54.315532Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12676-1","title":"nova-3.6.1-1.1 on GA media","description":"These are all security issues fixed in the nova-3.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:05.747256Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12682-1","title":"k9s-0.27.3-1.1 on GA media","description":"These are all security issues fixed in the k9s-0.27.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:38.307707Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12683-1","title":"pluto-5.13.3-1.1 on GA media","description":"These are all security issues fixed in the pluto-5.13.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:34.187089Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12692-1","title":"trivy-0.37.3-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.37.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:13.540914Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12695-1","title":"cilium-cli-0.12.13-1.1 on GA media","description":"These are all security issues fixed in the cilium-cli-0.12.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:45.933092Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12729-1","title":"terraform-provider-helm-2.9.0-1.1 on GA media","description":"These are all security issues fixed in the terraform-provider-helm-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:16.994138Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2025:15779-1","title":"helm3-3.19.2-1.1 on GA media","description":"These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-02-04T03:10:43.123465Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2023:1571-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.11.1 (bsc#1208084):\n\n- CVE-2023-25165: Fixed a information disclosure problem via getHostByName injection inside a chart to get values to a malicious DNS server.\n","status":"published","published":"2023-03-24T12:45:17Z","modified":"2026-02-04T04:36:29.948441Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1752-1","title":"Security update for terraform-provider-helm","description":"This update for terraform-provider-helm fixes the following issues:\n\n  Updated terraform-provider-helm to version 2.9.0:\n\n  - CVE-2023-25165: Fixed getHostByName Function Information Disclosure in helm embedded in the package (bsc#1208086).\n","status":"published","published":"2023-04-04T09:52:05Z","modified":"2026-02-04T04:33:11.663717Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2100-1","title":"Security update for terraform-provider-helm","description":"This update for terraform-provider-helm fixes the following issues:\n\n  Updated terraform-provider-helm to version 2.9.0:\n\n  - CVE-2023-25165: Fixed getHostByName Function Information Disclosure by updating embedded helm package (bsc#1208086).\n\n","status":"published","published":"2023-05-04T14:36:43Z","modified":"2026-02-04T03:41:24.188645Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}