CVE-2020-14470: 
Octopus Deploy vulnerability analysis and mitigation

In Octopus Deploy versions 2018.8.0 through 2019.x before 2019.12.2, a security vulnerability was identified where an authenticated user could trigger a deployment that would expose the Helm Chart repository password. This vulnerability was assigned CVE-2020-14470 and was discovered and disclosed in June 2020 (GitHub Issue).

The vulnerability exists in the Helm chart download functionality of Octopus Deploy. Under certain circumstances, when downloading a package from the helm feed, the feed password could be leaked to a deployment log. This meant that any authenticated user could potentially view passwords they were not authorized to access (GitHub Issue).

The primary impact of this vulnerability is the potential exposure of sensitive credentials. Authenticated users could gain unauthorized access to Helm Chart repository passwords through deployment logs, potentially compromising the security of the Helm repository (GitHub Issue).

The vulnerability requires an authenticated user account in the Octopus Deploy system to exploit. The attacker would need to trigger a deployment process that involves Helm chart downloads to expose the repository password in the deployment logs (GitHub Issue).

The vulnerability was patched in Octopus Deploy version 2019.12.2. Organizations using affected versions should upgrade to version 2019.12.2 or later. As an additional security measure, it is recommended to rotate feed passwords on a regular basis. No other workarounds were known at the time of disclosure (GitHub Issue).