Описание
Security update for helm
This update for helm fixes the following issues:
- CVE-2025-55199: crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
- CVE-2026-35206: files written to unexpected directory via specially crafted Chart(bsc#1261938).
Changes for helm:
- Update to version 3.20.2
Список пакетов
Container suse/helm:latest
Container suse/kubectl:1.33
Container suse/kubectl:latest
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Containers 15 SP7
SUSE Linux Enterprise Module for Package Hub 15 SP7
Ссылки
- Link for SUSE-SU-2026:1483-1
- E-Mail link for SUSE-SU-2026:1483-1
- SUSE Security Ratings
- SUSE Bug 1248093
- SUSE Bug 1261938
- SUSE CVE CVE-2025-55199 page
- SUSE CVE CVE-2026-35206 page
Описание
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.
Затронутые продукты
Ссылки
- CVE-2025-55199
- SUSE Bug 1248093
Описание
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
Затронутые продукты
Ссылки
- CVE-2026-35206
- SUSE Bug 1261938