CVE-2024-25620

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Impact

When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.

Patches

This issue has been resolved in Helm v3.14.1.

Workarounds

Check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Credits

Disclosed by Dominykas Blyžė at Nearform Ltd.

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Path traversal in helm.sh/helm/v3

These are all security issues fixed in the helm-3.14.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

helm was updated to fix the following issues:

Update to version 3.16.3:

• fix: fix label name
• Fix typo in pkg/lint/rules/chartfile_test.go
• Increasing the size of the runner used for releases.
• fix(hooks): correct hooks delete order
• Bump github.com/containerd/containerd from 1.7.12 to 1.7.23

Update to version 3.16.2:

• Revering change unrelated to issue #13176
• adds tests for handling of Helm index with broken chart versions #13176
• improves handling of Helm index with broken helm chart versions #13176
• Bump the k8s-io group with 7 updates
• adding check-latest:true
• Grammar fixes
• Fix typos

Update to version 3.16.1:

• bumping version to 1.22.7
• Merge pull request #13327 from mattfarina/revert-11726

Update to version 3.16.0:

Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience.

• Notable Changes
  • added sha512sum template function
  • added ActiveHelp for cmds that don't take any more args
  • drops very old Kubernetes versions support in helm create
  • add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint'
  • fixed bug to now use burst limit setting for discovery
  • Added windows arm64 support
• Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0

Update to version 3.15.4:

• Bump the k8s-io group across 1 directory with 7 updates
• Bump github.com/docker/docker

Thu Jul 11 05:39:32 UTC 2024 - [email protected]

• Update to version 3.15.3:
  • fix(helm): Use burst limit setting for discovery
  • fixed dependency_update_test.go
  • fix(dependencyBuild): prevent race condition in concurrent helm dependency
  • fix: respect proxy envvars on helm install/upgrade
  • Merge pull request #13085 from alex-kattathra-johnson/issue-12961

Update to version 3.15.2:

• fix: wrong cli description
• fix typo in load_plugins.go
• fix docs of DeployedAll
• Bump github.com/docker/docker
• bump oras minor version
• feat(load.go): add warning on requirements.lock

Update to version 3.15.1:

• Fixing build issue where wrong version is used

Update to version 3.15.0:

Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience.

• Updating to k8s 1.30 c4e37b3 (Matt Farina)
• bump version to v3.15.0 d7afa3b (Matt Farina)
• bump version to 7743467 (Matt Farina)
• Fix namespace on kubeconfig error 214fb6e (Calvin Krist)
• Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk M�ller)
• Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block)
• Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina)
• Fixing all the linting errors d58d7b3 (Robert Sirchia)
• Add a note about --dry-run displaying secrets a23dd9e (Matt Farina)
• Updating .gitignore 8b424ba (Robert Sirchia)
• add error messages 8d19bcb (George Jenkins)
• Fix: Ignore alias validation error for index load 68294fd (George Jenkins)
• validation fix 8e6a514 (Matt Farina)
• bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini)
• Update architecture detection method 57a1bb8 (weidongkl)
• Improve release action 4790bb9 (George Jenkins)
• Fix grammatical error c25736c (Matt Carr)
• Updated for review comments d2cf8c6 (MichaelMorris)
• Add robustness to wait status checks fc74964 (MichaelMorris)
• refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov)
• fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov)

Update to version 3.14.4:

Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

• refactor: create a helper for checking if a release is …

This update for helm fixes the following issues:

• CVE-2024-25620: Fixed with dependency management path traversal (bsc#1219969).
• CVE-2024-26147: Fixed uninitialized variable in yaml parsing (bsc#1220207).

This update for helm fixes the following issues:

• Update to version 3.17.2 (bsc#1238688, CVE-2025-22870):

  • Updating to 0.37.0 for x/net
  • build(deps): bump the k8s-io group with 7 updates

• Update to version 3.17.1:

  • merge null child chart objects
  • build(deps): bump the k8s-io group with 7 updates
  • fix: check group for resource info match

• Update to 3.17.0 (bsc#1235318, CVE-2024-45338):

  Full changelog:

  https://github.com/helm/helm/releases/tag/v3.17.0

  • Notable Changes

    • Allow pulling and installation by OCI digest
    • Annotations and dependencies are now in chart metadata output
    • New --take-ownership flag for install and upgrade commands
    • SDK: Authorizer and registry authorizer are now configurable
    • Removed the Kubernetes configuration file permissions check
    • Added username/password to helm push and dependency build/update subcommands
    • Added toYamlPretty template function

• Update to version 3.16.4 (bsc#1234482, CVE-2024-45337):

  • Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  • Bump the k8s-io group with 7 updates

This update for helm fixes the following issues:

• Update to version 3.17.2 (bsc#1238688, CVE-2025-22870):

  • Updating to 0.37.0 for x/net
  • build(deps): bump the k8s-io group with 7 updates

• Update to version 3.17.1:

  • merge null child chart objects
  • build(deps): bump the k8s-io group with 7 updates
  • fix: check group for resource info match

• Update to 3.17.0 (bsc#1235318, CVE-2024-45338):

  Full changelog: https://github.com/helm/helm/releases/tag/v3.17.0

  • Notable Changes

    • Allow pulling and installation by OCI digest
    • Annotations and dependencies are now in chart metadata output
    • New --take-ownership flag for install and upgrade commands
    • SDK: Authorizer and registry authorizer are now configurable
    • Removed the Kubernetes configuration file permissions check
    • Added username/password to helm push and dependency build/update subcommands
    • Added toYamlPretty template function

• Update to version 3.16.4 (bsc#1234482, CVE-2024-45337):

  • Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  • Bump the k8s-io group with 7 updates