GO-2023-1547

    Dashboard / Vulnerabilities / GO-2023-1547

    GO-2023-1547

    Published: 14 Feb 2023Last Modified: 4 Feb 2026

    Summary: Information disclosure in helm.sh/helm/v3

    Details: An information disclosure vulnerability exists in the getHostByName template function. The function getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with "helm install|upgrade|template" or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.

    References: https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8, https://github.com/helm/helm/commit/293b50c65d4d56187cd4e2f390f0ada46b4c4737

    Affected packages

    Package

    Name: helm.sh/helm/v3

    Purl: pkg:golang/helm.sh/helm/v3

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.11.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2023-1547 | CVE-DB