CLEANSTART-2026-GS02052 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the helm-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: authservice, openbao-fips, cortex, kargo, argo-events-fips, cloud-sql-proxy-fips, cloudflared, packer-fips, postgres-operator, weaviate, age, cloud-provider-azure-fips, cluster-autoscaler, tigera-operator, hugo-extended, x509-certificate-exporter-fips, k6, helm-fips,...

CVE-2024-24791 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, flannel-cni-plugin, crane, kargo, nri-kubernetes, cloud-sql-proxy-fips, cloudflared, sbom-convert, postgres-operator, smarter-device-manager-fips, weaviate, age, smarter-device-manager, tigera-operator, prometheus-redis-exporter-fips,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: dive, cortex, flannel-cni-plugin, crane, kargo, nri-kubernetes, cloud-sql-proxy-fips, cloudflared, postgres-operator, smarter-device-manager-fips, weaviate, age, smarter-device-manager, tigera-operator, prometheus-redis-exporter-fips, helm-fips, tekton-chains-fips,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: up, policy-controller, flux-image-reflector-controller, nerdctl, crane, kargo, ko-fips, kpt, docker-machine-driver-harvester, gitsign, vexctl, eksctl, buildkitd, docker-credential-gcr, falcoctl-fips, kots, helm-operator, guac, k8sgpt, kubescape, skaffold, dagger,...