Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. Impact The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory <output dir/, instead of the expected <output dir/<chart name/, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. Patches This issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will…
Recommended action: Upgrade to 4.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Helm is a package manager for Charts for Kubernetes. In Helm versions =4.0.0 and <=4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. Impact The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update. Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code. Patches This issue has been patched in Helm v4.1.4 Installing/updating a plugin with missing provenance will error if signature verification is required. Workarounds Users may manually validate that a plugin archive is not missing provenance data (.prov file) before installation.
Recommended action: Upgrade to 4.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Helm is a package manager for Charts for Kubernetes. In Helm versions =4.0.0 and <=4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. Impact A Helm user who installs or updates a plugin that is specially crafted can cause Helm to attempt to write the content of the affected plugin to an arbitrary location on the user's filesystem. Impacted users risk potentially overwriting user and system files which may further compromise the integrity of a system. Patches This issue has been patched in Helm v4.1.4 Installing/updating a plugin with a non-SemVer version (which excludes path traversal patterns) will result in an error. Workarounds Validate that the plugin.yaml of the Helm plugin does not include a version: field containing POSIX dot-dot path separators ie. "/../".
Recommended action: Upgrade to 4.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.