GO-2024-2575 Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3

Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3...

TotalCloud Container Security Best Practices

Qualys Container Security CS, an integral part of TotalCloud 2.0, provides a comprehensive view of the security posture of containerized applications. Operationalizing a new technology tool in an enterprise often presents its own challenges. This blog seeks to help the operations team familiarize...

CVE-2024-31216

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...

CVE-2024-31216 source-controller leaks theAzure Storage SAS token into logs on connection errors

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, sonobuoy, kaf, git-lfs, s5cmd, mc-fips, argo-workflows-fips, harbor-cli, timestamp-authority-fips, certificate-transparency-fips, vault-k8s-fips, falcosidekick, flux-notification-controller, helm-operator-fips, neuvector-scanner,...

PT-2024-40461 · Renovate · Renovate

Name of the Vulnerable Software and Affected Versions: Renovate versions 37.158.0 through 37.199.0 Description: Attackers with commit access to the default branch of a repository using Renovate could manipulate registryAliases to execute arbitrary commands. This is due to the registryAliases...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: policy-controller, cri-tools, docker, grype, k3d, buf, helm-push, kaniko, neuvector-scanner, harbor-scanner-trivy, melange, docker-compose, dagger, syft, wolfictl...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: policy-controller, wolfictl, kaniko, docker-compose, docker, dagger, helm-push, grype, k3d, neuvector-scanner, policy-controller-fips, syft, harbor-scanner-trivy-fips, harbor-scanner-trivy, melange, cri-tools, buf...

GHSA-X84C-P2G9-RQV9 vulnerabilities

Vulnerabilities for packages: policy-controller, wolfictl, kaniko, docker-compose, docker, dagger, helm-push, grype, k3d, neuvector-scanner, policy-controller-fips, syft, harbor-scanner-trivy-fips, harbor-scanner-trivy, melange, cri-tools, buf...

GHSA-X84C-P2G9-RQV9 vulnerabilities

Vulnerabilities for packages: policy-controller, cri-tools, docker, grype, k3d, buf, helm-push, kaniko, neuvector-scanner, harbor-scanner-trivy, melange, docker-compose, dagger, syft, wolfictl...

Important: Red Hat Enhancement Advisory: Advisory for publishing Helm 3.13.2 GA release

GA release of Helm 3.13.2 for OpenShift Container Platform 4.15 This errata advisory is for publishing the GA release of Helm 3.13.2 for OpenShift Container Platform 4.15...

Corezoid helm 安全漏洞

Corezoid helm is a library. A security vulnerability exists in Corezoid helm version v6.5.0, which originates from a vulnerability that allows an attacker to redirect to an arbitrary website by appending a crafted /login/ link to the login page URL...

argo-cd: uncontrolled memory allocation vulnerability

The ArgoCD repo-server component is vulnerable to a denial of service attack, where it is possible to crash the repo server component through an out-of-memory error by pointing it to a malicious Helm registry. The loadRepoIndex function in the ArgoCD's helm package does not limit the size or time...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2024:1137-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1137-1 advisory. - CVE-2024-25620: Fixed with dependency management path traversal bsc1219969. - CVE-2024-26147: Fixed uninitialized...

SUSE-SU-2024:1137-1 Security update for helm

This update for helm fixes the following issues: - CVE-2024-25620: Fixed with dependency management path traversal bsc1219969. - CVE-2024-26147: Fixed uninitialized variable in yaml parsing bsc1220207...

The vulnerability of the package manager for Kubernetes Helm, related to the lack of protection for service data, allows a attacker to influence the confidentiality of information.

The vulnerability of the package manager for Kubernetes Helm is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to influence the confidentiality of sensitive information...

AZL-39268 CVE-2023-45288 affecting package helm for versions less than 3.14.2-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-39004 CVE-2023-45288 affecting package helm for versions less than 3.15.2-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

The vulnerability of Helm’s diagram repository for deploying DataHub in a Kubernetes cluster relates to the use of the default cryptographic key. This allows attackers to generate a personal access token with a secret key by default.

The vulnerability of Helm’s diagram repository for deploying DataHub in a Kubernetes cluster is related to the use of the default cryptographic key. Exploiting this vulnerability could allow a malicious actor to generate a personal access token with the default secret key...

Denial Of Service (DoS)

github.com/argoproj/argo-cd/ is vulnerable to Denial Of Service. The vulnerability is due to the loadRepoIndex function in the ArgoCD's helm package, which lacks limitations on the size and time while fetching data. An attacker can point ArgoCD to a malicious Helm registry, which results in an ou...