PT-2025-5591 · Unknown+1 · Kube-Audit-Rest+1

Richardoc · Published 2025-01-29 · Updated 2025-02-11 · CVE-2025-24884

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions kube-audit-rest versions prior to 1.0.16

Description The issue concerns a simple logger of mutation/creation requests to the k8s API, where the previous values of Kubernetes secrets would have been disclosed in the audit messages if the "full-elastic-stack" example vector configuration was used for a real cluster.

Recommendations For versions prior to 1.0.16, update to version 1.0.16 to fix the issue. As a temporary workaround, replace the existing configuration in the vector "audit-files-json-parser-and-redaction" step with the updated configuration that redacts secret data and removes previously set secret data.

Exploit

Fix

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

CWE-212

Related Identifiers

CVE-2025-24884

GHSA-HCR5-WV4P-H2G2

GO-2025-3431

OPENSUSE-SU-2025:14732-1

OPENSUSE-SU-2025_0429-1

SUSE-SU-2025:0429-1

Affected Products

Suse

Kube-Audit-Rest

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24884.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24884 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24884 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcr5-wv4p-h2g2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14732-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3431 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0429-1 · Vendor Advisory
• https://github.com/RichardoC/kube-audit-rest/commit/db1aa5b867256b0a7bf206544c6981ab068b73dc · Note
• https://github.com/RichardoC/kube-audit-rest/security/advisories/GHSA-hcr5-wv4p-h2g2 · Note
• https://github.com/RichardoC/kube-audit-rest · Note
• https://pkg.go.dev/vuln/GO-2025-3431 · Note
• https://t.me/cvedetector/16707 · Telegram Post
• https://suse.com/security/cve/CVE-2025-24369 · Note
• https://suse.com/security/cve/CVE-2024-50354 · Note
• https://suse.com/security/cve/CVE-2022-47930 · Note