Security update for helm (moderate)

2019-07-1400:00:00

lists.opensuse.org

159

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.491 Medium

EPSS

Percentile

97.2%

JSON

An update that fixes three vulnerabilities is now available.

Description:

This update for helm to version 2.13.1 fixes the following issues:

set correct git_commit value so that ‘helm version’ reports correctly
added service file for helm-serve
Require golang 1.10.6 or newer
Tiller should only enforce what we expect from Helm
Keepalive config should be independent of TLS
Bump client side grpc max msg size
Update deprecated grpc dial timeout
Includes fixes which allow Helm to correctly recognize resources created
using the K8S 1.8/1.9 API namespaces

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2019-1703=1

OSVersionArchitecturePackageVersionFilename
SUSE Package Hub for SUSE Linux Enterprise12x86_64< - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
SUSE Package Hub for SUSE Linux Enterprise	12	x86_64		< - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):	- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):.x86_64.rpm