Skip to content
Fencer Vulns
medium 4.3

CVE-2023-25165 json

getHostByName Function Information Disclosure

published 2023-02-08 3 y ago modified 2026-09-10 1 mo ago also BIT-helm-2023-25165 , EUVD-2023-0766 , GHSA-pwcw-6f5g-gxf8 , GO-2023-1547

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.

Patch / fix

  • go helm.sh/helm/v3 3.11.1
  • bitnami helm 3.11.1
  • helm helm 3.11.1
  • terraform-provider-helm SLE Module for Public Cloud 15 SP1 2.9.0-150100.3.6.3
  • terraform-provider-helm SLE Module for Public Cloud 15 SP4, SLE Module for Public Cloud 15 SP3, SLE Module for Public Cloud 15 SP2 +1 more 2.9.0-150200.6.8.1
  • helm SLE Module for Package Hub 15 SP4, SLE Module for Containers 15 SP4, openSUSE Leap 15.4 3.11.1-150000.1.16.1

suse advisories SUSE-SU-2023:2100-1SUSE-SU-2023:1752-1SUSE-SU-2023:1571-1

  • helm3 openSUSE Tumbleweed 3.19.2-1.1
  • helm openSUSE Tumbleweed 3.11.1-1.1
  • helmfile openSUSE Tumbleweed 0.150.0-2.1
  • nova openSUSE Tumbleweed 3.6.1-1.1
  • k9s openSUSE Tumbleweed 0.27.3-1.1
  • pluto openSUSE Tumbleweed 5.13.3-1.1
  • trivy openSUSE Tumbleweed 0.37.3-1.1
  • cilium-cli openSUSE Tumbleweed 0.12.13-1.1

opensuse advisories openSUSE-SU-2025:15779-1openSUSE-SU-2024:12667-1openSUSE-SU-2024:12668-1openSUSE-SU-2024:12676-1openSUSE-SU-2024:12682-1openSUSE-SU-2024:12683-1

  • cert-manager CBL-Mariner 2.0 1.7.3-8
  • helm CBL-Mariner 2.0 3.10.3-3

azure linux advisories AZL-13300AZL-13558

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-25165 updated cvss 4.3

helm: getHostByName Function Information Disclosure

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Cryostat 2 cryostat-tech-preview/cryostat-rhel8-operator
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services jenkins-operator-container
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/ingress-rhel8-operator Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/oc-mirror-plugin-rhel8, openshift4/ose-operator-marketplace, openshift4/ose-gcp-pd-csi-driver-rhel9, openshift4/ose-metering-ansible-operator, openshift4/special-resource-rhel8-operator, +8 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8
    affected: no fix available
  • Red Hat Openshift Container Storage 4 ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 odf4/odf-lvm-rhel8-operator, odf4/odf-multicluster-rhel9-operator
    affected: no fix available, no fix planned “Will not fix”
show 5 more
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cluster-network-addons-operator-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-console-operator v4.12.0-202403060808.p0.g7ea10a2.assembly.stream.el8
    fixed: vendor fix RHSA-2024:1265
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-console-operator v4.13.0-202304280015.p0.g0ce3d0b.assembly.stream, openshift4/ose-olm-rukpak-rhel8 v4.13.0-202304190216.p0.g66b3e55.assembly.stream
    fixed: vendor fix RHSA-2023:1326
  • Red Hat OpenShift Container Platform 4.14 openshift4/oc-mirror-plugin-rhel8 v4.14.0-202310201027.p0.g68cf97e.assembly.stream, openshift4/ose-azure-cluster-api-controllers-rhel8 v4.14.0-202310201027.p0.gc015df4.assembly.stream, openshift4/ose-cluster-platform-operators-manager-rhel8 v4.14.0-202310201027.p0.g08fb27e.assembly.stream
    fixed: vendor fix RHSA-2023:5006
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/ose-ptp-operator, redhat/redhat-operator-index, openshift4/ose-hypershift-rhel9, openshift4/metallb-rhel8-operator, openshift4/ose-operator-sdk-rhel8, +4 more Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202403120448-0, openshift4/ose-cli v4.12.0-202403060808.p0.gd4c9e3c.assembly.stream.el8, openshift4/ose-pod v4.12.0-202403060808.p0.g9946c63.assembly.stream.el8, openshift4/ose-etcd v4.12.0-202403060808.p0.gbb43fb5.assembly.stream.el8, openshift4/ose-tests v4.12.0-202403120507.p0.g7b7d4ef.assembly.stream.el8, openshift4/ose-console v4.12.0-202403080208.p0.g5d4bea1.assembly.stream.el8, +185 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-cli v4.13.0-202304190216.p0.g92b1a3d.assembly.stream, openshift4/ose-pod v4.13.0-202304211155.p0.gb404935.assembly.stream, openshift4/ose-etcd v4.13.0-202304190216.p0.gf70da9d.assembly.stream, openshift4/ose-tests v4.13.0-202305031828.p0.g893ae57.assembly.stream, openshift4/ose-console v4.13.0-202305031828.p0.ga551d28.assembly.stream, openshift4/ose-coredns v4.13.0-202304190216.p0.g5560e4a.assembly.stream, +173 more
    +4 more products
    Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202310210434-0, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, openshift4/ose-console v4.14.0-202310201027.p0.gc16ab01.assembly.stream, openshift4/ose-coredns v4.14.0-202310201027.p0.gfd70cf1.assembly.stream, +178 more Red Hat Openshift Data Foundation 4 odf4/ocs-rhel9-operator, odf4/odf-rhel8-operator, odf4/odr-rhel9-operator, odf4/rook-ceph-rhel9-operator, odf4/odf-csi-addons-sidecar-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/gitops-rhel8-operator Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go helm.sh/helm/v3
>=3.0.0, <3.11.1
<3.11.1
3.11.1
bitnami helm
>=3.0.0, <3.11.1
3.11.1

Affected products

  • helm helm

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.