CVE-2019-25210: Helm shows secrets in clear text
(updated )
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm. It displays values of secrets when the –dry-run flag is used. This is a security concern in some use cases, such as a –dry-run call by a CI/CD tool. NOTE: the vendor’s position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).
References
Code Behaviors & Features
Detect and mitigate CVE-2019-25210 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →