Описание
Security update for helm
This update for helm fixes the following issues
Security issues:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
Non security issue:
- Update to version 3.21.0.
- Fix packages for %suse_version bump (jsc#PED-15794)
Список пакетов
openSUSE Leap 16.0
helm-3.21.0-160000.1.1
helm-bash-completion-3.21.0-160000.1.1
helm-fish-completion-3.21.0-160000.1.1
helm-zsh-completion-3.21.0-160000.1.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1265428
- SUSE Bug 1265758
- SUSE CVE CVE-2026-33814 page
- SUSE CVE CVE-2026-41888 page
Описание
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Затронутые продукты
openSUSE Leap 16.0:helm-3.21.0-160000.1.1
openSUSE Leap 16.0:helm-bash-completion-3.21.0-160000.1.1
openSUSE Leap 16.0:helm-fish-completion-3.21.0-160000.1.1
openSUSE Leap 16.0:helm-zsh-completion-3.21.0-160000.1.1
Ссылки
- CVE-2026-33814
- SUSE Bug 1264506
Описание
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
Затронутые продукты
openSUSE Leap 16.0:helm-3.21.0-160000.1.1
openSUSE Leap 16.0:helm-bash-completion-3.21.0-160000.1.1
openSUSE Leap 16.0:helm-fish-completion-3.21.0-160000.1.1
openSUSE Leap 16.0:helm-zsh-completion-3.21.0-160000.1.1
Ссылки
- CVE-2026-41888
- SUSE Bug 1265422