GHSA-9C5P-35GJ-JQP4 Rancher Helm Applications may have sensitive values leaked

Impact A vulnerability has been identified within Rancher Manager whereby applications installed via Rancher Manager Apps Catalog store their Helm values directly into the Apps Custom Resource Definition, resulting in any users with GET access to it to be able to read any sensitive information th...

PT-2024-35150 · Rancher · Rancher Manager

Name of the Vulnerable Software and Affected Versions: Rancher Manager versions prior to 2.8.10 Rancher Manager versions prior to 2.9.5 Description: A vulnerability has been identified in Rancher Manager where applications installed via the Apps Catalog store their Helm values directly into the...

Path Traversal

helm.sh/helm is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in chart archives, which allows files to be extracted outside the target directory when unpacking...

Credentials Exposure

github.com/argoproj/argo-cd is vulnerable to Credentials Exposure. The vulnerability is due to the inappropriate handling and logging of sensitive authentication information within pod logs when connected to a Helm OCI repository with authentication enabled, allows individuals with access to the...

Malicious code in @fdp-tools/helm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bef4a02ea616732eda209303ce418b0fbf07d43995a8ac48bada7b7967f78819 The OpenSSF Package Analysis project identified '@fdp-tools/helm' @ 0.1.11 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9106 Malicious code in @fdp-tools/helm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bef4a02ea616732eda209303ce418b0fbf07d43995a8ac48bada7b7967f78819 The OpenSSF Package Analysis project identified '@fdp-tools/helm' @ 0.1.11 npm as malicious. It is considered malicious because: - The package...

RHEA-2024:1870 Red Hat Enhancement Advisory: Advisory for publishing Helm 3.13.2 GA release

Bulletin has no description...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.17.0 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

SUSE-SU-2024:3266-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus: - Security issues fixed: CVE-2024-6104: Update go-retryablehttp to version 0.7.7 bsc1227038 CVE-2023-45142: Updated otelhttp to version 0.46.1 bsc1228556 - Require Go 1.20 for building - Migrate from disabled to manual...

Fedora: Security Advisory (FEDORA-2023-46c95e2c57)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GO-2022-0387 Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd

Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd...

GO-2023-2085 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server in github.com/argoproj/argo-cd

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server in github.com/argoproj/argo-cd...

GHSA-H27C-6XM3-MCQP Withdrawn Advisory: Kanister vulnerable to cluster-level privilege escalation

Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not affect a released Go package. For more information, see github/advisory-database/issues/5029. Original Advisory Summary This advisory affects the Kanister helm charts and not the go package Details The kanister...

GO-2023-1993 Helm Improper Certificate Validation in helm.sh/helm

Helm Improper Certificate Validation in helm.sh/helm...

GO-2023-1938 Helm Unsafe Link Following in helm.sh/helm

Helm Unsafe Link Following in helm.sh/helm...

GO-2023-1948 Helm Path Traversal in helm.sh/helm

Helm Path Traversal in helm.sh/helm...

PT-2024-30561 · Kanister +1 · Kanister +1

Name of the Vulnerable Software and Affected Versions: Kanister affected versions not specified Description: Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding...

CBL Mariner 2.0 Security Update: cert-manager / helm (CVE-2024-25620)

The version of cert-manager / helm installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-25620 advisory. - Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources...

PT-2024-29969 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions 1.5.7 through 1.5.8 Description: OpenFGA is an authorization/permission engine. The issue concerns an authorization bypass when calling the Check API with a model that uses but not and from expressions and a userset...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, k3d, loki-fips, rancher, crossplane, helm-push, prometheus, bom, syft, argo-workflows, flux-image-reflector-controller, scorecard, harbor-scanner-trivy-fips, buf, opentelemetry-collector-fips, gh, chartmuseum, docker, flux-helm-controller, gitsign,...