CVE-2024-52284
Fixed in a distro release EPSS <1%CVSS 7.7
Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/fleet | 0.13.1-0.20250806151509-088bcbea7edb |
| Go | github.com/rancher/fleet | 0.12.6 |
| Go | github.com/rancher/fleet | 0.11.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 |
| Ubuntu:16.04:LTS | fleet | no fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250908T141310-1.1 |