Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-5xqw-8hwv-wg92

Опубликовано: 10 апр. 2025
Источник: github
Github: Прошло ревью
CVSS3: 6.5

Описание

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.

Impact

A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Пакеты

Наименование

helm.sh/helm/v3

go
Затронутые версииВерсия исправления

< 3.17.3

3.17.3

EPSS

Процентиль: 2%
0.00015
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-121
CWE-674

Связанные уязвимости

CVSS3: 6.5
ubuntu
2 месяца назад

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.

CVSS3: 6.5
redhat
2 месяца назад

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.

CVSS3: 6.5
nvd
2 месяца назад

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.

CVSS3: 6.5
msrc
24 дня назад

Описание отсутствует

CVSS3: 6.5
debian
2 месяца назад

Helm is a package manager for Charts for Kubernetes. A JSON Schema fil ...

EPSS

Процентиль: 2%
0.00015
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-121
CWE-674