CVE-2023-25165 getHostByName Function Information Disclosure
A malicious Helm chart can use the getHostByName function to leak sensitive template values to attacker-controlled DNS servers during installation or rendering.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25165?
CVE-2023-25165 is a medium-severity vulnerability in helm, published on 8 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.
Weakness: CWE-200
Which versions are affected by CVE-2023-25165?
4 open source packages ship an affected version, including helm.sh/helm/v3 and helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm.sh/helm/v3 Go | All versions | 3.11.1 |
helm.sh/helm/v3 Go | From 3.0.0 | 3.11.1 |
helm.sh/helm/v3 Go | From 3.0.0 | 3.11.1 |
helm Bitnami | From 3.0.0 | 3.11.1 |
Linux distribution packages (18)
helm SUSE:Linux Enterprise Module for Containers 15 SP4 | All versions | 3.11.1-150000.1.16.1 |
helm SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 3.11.1-150000.1.16.1 |
terraform-provider-helm SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 2.9.0-150100.3.6.3 |
terraform-provider-helm SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 2.9.0-150200.6.8.1 |
terraform-provider-helm SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 2.9.0-150200.6.8.1 |
terraform-provider-helm SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 2.9.0-150200.6.8.1 |
trivy SUSE:Package Hub 15 SP4 | All versions | 0.37.3-bp154.2.9.1 |
helm openSUSE:Leap 15.4 | All versions | 3.11.1-150000.1.16.1 |
terraform-provider-helm openSUSE:Leap 15.4 | All versions | 2.9.0-150200.6.8.1 |
trivy openSUSE:Leap 15.4 | All versions | 0.37.3-bp154.2.9.1 |
cilium-cli openSUSE:Tumbleweed | All versions | 0.12.13-1.1 |
helm openSUSE:Tumbleweed | All versions | 3.11.1-1.1 |
helmfile openSUSE:Tumbleweed | All versions | 0.150.0-2.1 |
k9s openSUSE:Tumbleweed | All versions | 0.27.3-1.1 |
nova openSUSE:Tumbleweed | All versions | 3.6.1-1.1 |
pluto openSUSE:Tumbleweed | All versions | 5.13.3-1.1 |
terraform-provider-helm openSUSE:Tumbleweed | All versions | 2.9.0-1.1 |
trivy openSUSE:Tumbleweed | All versions | 0.37.3-1.1 |
Products include Helm Helm.
How do I fix CVE-2023-25165?
Upgrade helm.sh/helm/v3 to 3.11.1 or later.
Is CVE-2023-25165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25165 exists.
Other vulnerabilities in helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
Sources
Also known as AZL-13300, AZL-13558, BIT-helm-2023-25165, CLEANSTART-2026-UY62057, GHSA-pwcw-6f5g-gxf8, GO-2023-1547 and 12 more.