CVE-2024-25620

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

Helm Path Traversal Vulnerability

Helm is a Kubernetes package manager. A path traversal vulnerability exists in Helm versions prior to 3.14.0, which stems from the presence of path traversal...

CVE-2024-25620 Dependency management path traversal in helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

CVE-2024-25620

CVE-2024-25620 – Helm path traversal vulnerability : The connected Nessus entry confirms a concrete issue in Helm where saving a chart with a relative path in Chart.yaml can cause the chart to be saved outside its intended directory. This is due to improper validation of user-supplied input, enab...

CVE-2024-25620 Dependency management path traversal in helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

CVE-2024-25620 Dependency management path traversal in helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

PT-2024-4076 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.14.1 Description: The issue is related to the Helm client or SDK saving a chart outside its expected directory based on changes in the relative path within the Chart.yaml file. This occurs when the chart's name includ...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, policy-controller, gitsign, kargo, flux-image-reflector-controller, kubevela, falcoctl, pulumi, cadvisor, nerdctl, helm-operator-fips, kubeflow-katib, zarf, kpt, vexctl, k8sgpt, flux, loki, chartmuseum, skaffold, k3d, policy-controller-fips, guac...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, policy-controller, gitsign, kargo, flux-image-reflector-controller, kubevela, falcoctl, pulumi, cadvisor, nerdctl, helm-operator-fips, kubeflow-katib, zarf, kpt, vexctl, k8sgpt, flux, loki, chartmuseum, skaffold, k3d, policy-controller-fips, guac...

CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

CVE-2023-44487 affecting package helm for versions less than 3.14.0-1. An upgraded version of the package is available that resolves this issue...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: gitness, kubevela, k8sgpt, helm-push, skaffold, k3d, newrelic-infrastructure-agent, zot, up, melange, flux-helm-controller, helm, kots, flux-source-controller, grype, trivy, cilium-cli, kaniko, kubescape, eksctl, ctop, buildkitd, fuse-overlayfs-snapshotter...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: vault-k8s, prometheus-statsd-exporter-fips, gh, temporal-server, pulumi, trillian, crossplane-provider-family-azure, hugo, temporal-fips, spire-server-fips, certificate-transparency-fips, src-fingerprint, fq, crossplane-provider-azure-sql, dex-k8s-authenticator,...

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1. An upgraded version of the package is available that resolves this issue...

olcne security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...

CVE-2023-47640

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

Default credentials

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...