PT-2025-35331 · Suse · Suse Fleet

Published 2025-08-29 · Updated 2025-10-07 · CVE-2024-52284

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SUSE Fleet versions prior to v0.14.0 SUSE Fleet version v0.13.1 SUSE Fleet version v0.12.6 SUSE Fleet version v0.11.10

Description A vulnerability exists in SUSE Fleet when managing Helm charts, where sensitive information passed through BundleDeployment.Spec.Options.Helm.Values may be stored in plain text. This can lead to unauthorized disclosure of sensitive data to users with GET or LIST permissions on BundleDeployment resources, and a lack of encryption at rest for these values. The issue arises because BundleDeployment is not configured for Kubernetes encryption at rest by default. This behavior differs from Helm v3’s default approach, where chart state is stored in Kubernetes secrets. The exposure of credentials can have varying impacts on confidentiality, integrity, and availability, depending on the permissions associated with the leaked credentials.

Recommendations Upgrade to SUSE Fleet version v0.14.0 or later. Upgrade to SUSE Fleet version v0.13.1. Upgrade to SUSE Fleet version v0.12.6. Upgrade to SUSE Fleet version v0.11.10. If upgrading is not possible, specify paths to valuesFiles as simple file names, for example, use values.yaml instead of config-chart/values.yaml.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2024-52284

GHSA-6H9X-9J5V-7W9H

GO-2025-3927

OPENSUSE-SU-2025:15538-1

SUSE-SU-2025:03289-1

Affected Products

Suse Fleet

References · 59

• https://cve.org/CVERecord?id=CVE-2024-52284 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-52284 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52284 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15538-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6h9x-9j5v-7w9h · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52284 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3927 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://github.com/rancher/fleet · Note
• https://github.com/rancher/fleet/commit/088bcbea7edb844d7e6fc3649d9954f763cf68a9 · Note
• https://github.com/rancher/fleet/security/advisories/GHSA-6h9x-9j5v-7w9h · Note
• https://t.me/pentestingnews/67272 · Telegram Post
• https://suse.com/security/cve/CVE-2025-58450 · Note
• https://suse.com/support/update/announcement/2025/suse-su-202503289-1 · Note
• https://twitter.com/cracbot/status/1964644870733078666 · Twitter Post