Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20994-1

Опубликовано: 21 июн. 2026
Источник: suse-cvrf

Описание

Security update for helm

This update for helm fixes the following issue

  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).

Changes for helm:

  • Update to version 3.21.1:
  • Fixed nil pointer panic that could happen with helm template in ClientOnly flows. Now correctly returns a template error #31920
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32152
  • Bumped Go from 1.25 to 1.26 #32168
  • Dependency version updates
    • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
    • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
    • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
    • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
    • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
    • chore(deps): bump github.com/distribution/distribution/v3
    • chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32
    • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0
    • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13
    • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
    • chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0
    • chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0

Список пакетов

openSUSE Leap 16.0
helm-3.21.1-160000.1.1
helm-bash-completion-3.21.1-160000.1.2
helm-fish-completion-3.21.1-160000.1.2
helm-zsh-completion-3.21.1-160000.1.2

Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:helm-3.21.1-160000.1.1
openSUSE Leap 16.0:helm-bash-completion-3.21.1-160000.1.2
openSUSE Leap 16.0:helm-fish-completion-3.21.1-160000.1.2
openSUSE Leap 16.0:helm-zsh-completion-3.21.1-160000.1.2
Ссылки