Bug 2168458 (CVE-2023-25165)

Summary:	CVE-2023-25165 helm: getHostByName Function Information Disclosure
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abenaiss, amackenz, amasferr, amctagga, chazlett, dfreiber, eaguilar, ebaron, eglynn, ellin, fdeutsch, gparvin, jburrell, jjoyce, jkang, jpallich, jwendell, lball, lgamliel, lhh, matzew, mburns, mfilanov, mgarciac, mkudlej, muagarwa, nbecker, njean, nobody, ocs-bugs, oramraz, ovanders, owatkins, pahickey, phoracek, pjindal, rcernich, rfreiman, rgarg, rhos-maint, rhuss, rogbas, scorneli, sfroberg, shbose, smullick, spower, stcannon, teagle, tjochec, tnielsen, twalsh, ubhargav, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	helm 3.11.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the helm package. The 'getHostByName' is a Helm template function introduced in Helm v3 and can accept a hostname and return an IP address for that hostname. To get the IP address, the function performs a DNS lookup. The DNS lookup happens when used with 'helm install\|upgrade\|template' or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to look up the IP address. For example, a malicious chart could inject getHostByName into a chart to disclose values to a malicious DNS server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-18 04:45:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2170788, 2170789, 2170790, 2170791, 2170792, 2170793, 2170794, 2170795, 2170796, 2170797
Bug Blocks:	2168437

Description Avinash Hanwate 2023-02-09 04:35:53 UTC

Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.

https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2
https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8

Comment 8 errata-xmlrpc 2023-05-17 22:31:25 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326

Comment 9 Product Security DevOps Team 2023-05-18 04:45:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-25165

Comment 10 errata-xmlrpc 2023-10-31 12:54:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2023:5006 https://access.redhat.com/errata/RHSA-2023:5006

Comment 12 errata-xmlrpc 2024-03-20 01:29:37 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2024:1265 https://access.redhat.com/errata/RHSA-2024:1265