{"id":"CVE-2023-25165","published":"2023-02-08T19:07:14Z","modified":"2025-03-10T21:15:03Z","title":"getHostByName Function Information Disclosure","vendor":"helm","product":"helm","tier":"tail","description":{"text":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00768,"percentile":0.55595,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2","tags":["x_refsource_MISC"]}],"priority":{"score":14.1,"factors":[{"name":"EPSS percentile","points":11.12},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"helm","affectedVersions":[{"vendor":"helm","product":"helm","versions":[">= 3.0.0, < 3.11.1"]}],"affected":[{"ecosystem":"Go","package":"helm.sh/helm/v3","vulnerableRanges":[">=3.0.0, <3.11.1","<3.11.1"],"patched":["3.11.1"],"from":["GHSA-pwcw-6f5g-gxf8","GO-2023-1547"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0766","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-23524","published":"2022-12-15","fixed":"3.10.3","kev":false},{"cve":"CVE-2022-23525","published":"2022-12-15","fixed":"3.10.3","kev":false,"link":{"from":"CVE-2022-23525","to":"CVE-2023-25165","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:helm.sh/helm/v3","fromFixed":"3.10.3","toFixed":"3.11.1","daysApart":55}]}},{"cve":"CVE-2022-23526","published":"2022-12-15","fixed":"3.10.3","kev":false},{"cve":"CVE-2023-25165","published":"2023-02-08","fixed":"3.11.1","kev":false},{"cve":"CVE-2024-25620","published":"2024-02-14","fixed":"3.14.1","kev":false,"link":{"from":"CVE-2023-25165","to":"CVE-2024-25620","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:helm.sh/helm/v3","fromFixed":"3.11.1","toFixed":"3.14.1","daysApart":371}]}},{"cve":"CVE-2024-26147","published":"2024-02-21","fixed":"3.14.2","kev":false},{"cve":"CVE-2025-32386","published":"2025-04-09","fixed":"3.17.3","kev":false}],"package":"Go:helm.sh/helm/v3"}}