Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3882-1

Опубликовано: 31 авг. 2026
Источник: suse-cvrf

Описание

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

  • Bump vendor to address various security issues:
    • golang.org/x/mod@v0.40.0
    • oras.land/oras-go/v2@v2.6.2
    • google.golang.org/grpc@v1.82.1
    • go.opentelemetry.io/otel@v1.44.0

Список пакетов

Container suse/kubectl:1.35
helm-3.21.3-150000.1.93.1
Container suse/kubectl:latest
helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Micro 5.5
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Module for Containers 15 SP7
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Module for Package Hub 15 SP7
helm-fish-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Server 15 SP4-LTSS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Server 15 SP5-LTSS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Server 15 SP6-LTSS
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
helm-3.21.3-150000.1.93.1
helm-bash-completion-3.21.3-150000.1.93.1
helm-zsh-completion-3.21.3-150000.1.93.1

Ссылки

Описание

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Затронутые продукты
Container suse/kubectl:1.35:helm-3.21.3-150000.1.93.1
Container suse/kubectl:latest:helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:helm-bash-completion-3.21.3-150000.1.93.1
Ссылки

Описание

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Затронутые продукты
Container suse/kubectl:1.35:helm-3.21.3-150000.1.93.1
Container suse/kubectl:latest:helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:helm-bash-completion-3.21.3-150000.1.93.1
Ссылки

Описание

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Затронутые продукты
Container suse/kubectl:1.35:helm-3.21.3-150000.1.93.1
Container suse/kubectl:latest:helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:helm-3.21.3-150000.1.93.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:helm-bash-completion-3.21.3-150000.1.93.1
Ссылки
Уязвимость SUSE-SU-2026:3882-1