GO-2022-1167 Denial of service in string value parsing in helm.sh/helm/v3

Applications that use the strvals package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes an error that cannot be recovered from. The strvals package contains a parser that turns strings into Go structures. For example, the Helm client has comman...

PT-2022-16050

Name of the Vulnerable Software and Affected Versions Helm versions prior to 3.10.3 Description Helm is a tool for managing Charts, pre-configured Kubernetes resources. The issue results in Uncontrolled Resource Consumption, leading to Denial of Service. Input to functions in the strvals package...

PT-2022-16051

Name of the Vulnerable Software and Affected Versions Helm versions prior to 3.10.3 Description The issue concerns a NULL Pointer Dereference in the repo package of Helm, which can lead to a Denial of Service. The repo package processes the index file of a repository and loads it into structures...

Helm vulnerable to denial of service through through repository index file

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the repo package that can cause a segmentation violation. Applications that use functions from the repo package in the Helm SDK can have a Denial of Service attack when they use this package and it panics...

Helm vulnerable to denial of service through string value parsing

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the strvals package that can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the strvals package in the Helm SDK can have a Denial of Service atta...

Helm vulnerable to denial of service through schema file

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the chartutil package that can cause a segmentation violation. Applications that use functions from the chartutil package in the Helm SDK can have a Denial of Service attack when they use this package and it...

PT-2022-16052

Name of the Vulnerable Software and Affected Versions Helm versions prior to 3.10.3 Description The issue concerns a NULL Pointer Dereference in the chartutil package that can cause a segmentation violation. This package contains a parser that loads a JSON Schema validation file, which can be use...

Security fix for the ALT Linux 10 package helm version 3.10.2-alt1

3.10.2-alt1 built Dec. 8, 2022 Mikhail Gordeev in task 311367 Dec. 3, 2022 Mikhail Gordeev - new version 3.10.2 - Fixes: CVE-2022-36055 CVE-2022-36049 CVE-2021-32690 CVE-2021-21303...

GHSA-2QJP-425J-52J9 vulnerabilities

Vulnerabilities for packages: ctop...

CVE-2022-23471 vulnerabilities

Vulnerabilities for packages: ctop...

GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela

When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2016-1000023 DESCRIPTION: Minimatch is vulnerable to a denial of service, caused...

kubernetes security update

kubernetes 1.22.16-1 - Added Oracle specific build files for Kubernetes - Add preBuildOL8Commands to Jenkinsfile kubernetes 1.23.14-1 - Added Oracle specific build files for Kubernetes kubernetes 1.24.8-1 - Added Oracle specific build files for Kubernetes olcne 1.5.8-4 - Fix 1.21 kubernetes versi...

KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

Server side request forgery (ssrf)

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

CVE-2022-36055 affecting package helm for versions less than 3.9.4-2

CVE-2022-36055 affecting package helm for versions less than 3.9.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-36049 affecting package helm for versions less than 3.9.4-2

CVE-2022-36049 affecting package helm for versions less than 3.9.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-39383

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

PT-2022-24943 · Kubevela · Kubevela

Name of the Vulnerable Software and Affected Versions: KubeVela versions 1.5 through 1.5.7 KubeVela versions 1.6 through 1.6.0 Description: KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this issue. When using Helm Chart as the...

CVE-2022-39383: Server-Side Request Forgery (SSRF)

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...