modules:
  - module: helm.sh/helm/v3
    versions:
      - fixed: 3.10.3
    vulnerable_at: 3.10.2
    packages:
      - package: helm.sh/helm/v3/pkg/chartutil
        symbols:
          - ValidateAgainstSingleSchema
        derived_symbols:
          - ToRenderValues
          - ValidateAgainstSchema
description: |
    Certain JSON schema validation files can cause a Helm Client to panic,
    leading to a possible denial of service.

    The chartutil package contains a parser that loads a JSON Schema validation
    file. For example, the Helm client when rendering a chart will validate its
    values with the schema file. The chartutil package parses the schema file
    and loads it into memory, but some schema files can cause array
    data structures to be created causing a memory violation.

    The Helm Client will panic with a schema file that causes a memory violation
    panic. Helm is not a long running service so the panic will not affect
    future uses of the Helm client.
cves:
  - CVE-2022-23526
ghsas:
  - GHSA-67fx-wx78-jx33
credit: Ada Logics, in a fuzzing audit sponsored by CNCF
references:
  - advisory: https://github.com/helm/helm/security/advisories/GHSA-67fx-wx78-jx33
  - fix: https://github.com/helm/helm/commit/bafafa8bb1b571b61d7a9528da8d40c307dade3d