Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN566
_____________________________________________________________________

DATE                : 02/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running github.com/rancher/fleet (Go)
                 versions prior to 0.14.0, 0.13.1, 0.12.6, 0.11.10.

=====================================================================
https://github.com/rancher/rancher/security/advisories/GHSA-4h45-jpvh-6p5j
_____________________________________________________________________

Helm Values are stored inside BundleDeployment in plain text
High
samjustus published GHSA-6h9x-9j5v-7w9h Aug 28, 2025

Package
github.com/rancher/fleet (Go)

Affected versions
<0.14.0
>=0.13.0, <0.13.1
>=0.12.0, <0.12.6
>=0.11.0, <0.11.10

Patched versions
0.14.0
0.13.1
0.12.6
0.11.10


Description

Impact

A vulnerability has been identified when using Fleet to manage Helm
charts where sensitive information is passed through
BundleDeployment.Spec.Options.Helm.Values may be stored in plain
text. This can result in:

    Unauthorized disclosure of sensitive data: Any user with GET or
LIST permissions on BundleDeployment resources could retrieve Helm
values containing credentials or other secrets.

    Lack of encryption at rest: BundleDeployment is not configured
for Kubernetes encryption at rest by default, causing sensitive
values to remain unencrypted within the cluster datastore.

This behavior differs from Helm v3’s default approach, where chart
state — including values — is stored in Kubernetes secrets, benefiting
from built-in protection mechanisms. In affected scenarios,
credentials and other sensitive information are exposed both at
rest and in responses to API calls.

Please consult the associated MITRE ATT&CK - Technique - Credentials
from Password Stores for further information about this category of
attack.

For the exposure of credentials not related to Rancher, the final
impact severity for confidentiality, integrity, and availability is
dependent on the permissions that the leaked credentials have on
their own services.

It is recommended to review the potentially exposed sensitive data
in this scenario and change secrets, tokens, and passwords as
necessary.
Patches

This vulnerability is addressed by adding the capability for each
Bundle and BundleDeployment to have a secret to store options in.

    The git job that runs fleet apply will now create secrets for
Helm values.

    Fleet controller generates bundledeployments and now creates
a Helm values secret per bundle deployment in the cluster namespace.
    Fleet agent uses the bundledeployment for options, the
content resource and the secret to deploy the bundle.

Patched versions of Fleet include releases v0.14.0, v0.13.1,
v0.12.6 and v0.11.10.
Workarounds

If you can't upgrade to a fixed version, please make sure to
specify paths to valuesFiles as simple file names, e.g.:

Instead of:

helm:
  valuesFiles:
    - config-chart/values.yaml # will not be excluded → risky

Use:

helm:
  valuesFiles:
    - values.yaml # will be excluded

References

If you have any questions or comments about this advisory:

    Reach out to the SUSE Rancher Security team for security
related inquiries.
    Open an issue in the Rancher repository.
    Verify with our support matrix and product support
lifecycle.


Severity
High
7.7/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE ID
CVE-2024-52284

Weaknesses
No CWEs


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================