GHSA-hcr5-wv4p-h2g2 kube-audit-rest's example logging configuration could disclose secret values in the audit log

• Go github.com/RichardoC/kube-audit-rest: < 0.0.0-20250205113217-9df8886b4819 → fixed in 0.0.0-20250205113217-9df8886b4819

Impact _What kind of vulnerability is it? Who is impacted?_ If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. Patches _Has the problem been patched? What versions should users upgrade to?_ The example has been updated to fix this in commit 9df8886b4819409f566233adc7c3b7a43a4096ba Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Replace ```yaml if .request.requestKind.kind == "Secret" { del(.request.object.data) .request.object.data.redacted = "REDACTED" del(.request.oldObject.data) .request.oldObject.data.redacted = "REDACTED" } ``` In the vector "audit-files-json-parser-and-redaction" step with ```yaml if .request.requestKind.kind == "Secret" { # Redact the secret data del(.request.object.data) .request.object.data.redacted = "REDACTED" del(.request.oldObject.data) .request.oldObject.data.redacted = "REDACTED" # Remove the previously set secret data - Not bothering to parse it as this annotation shouldn't ever be needed del(.request.object.metadata.annotations.["kubectl.kubernetes.io/last-applied-configuration"]) del(.request.oldObject.metadata.annotations.["kubectl.kubernetes.io/last-applied-configuration"]) } ``` References _Are there any links users can visit to find out more?_