| Tatiana Bradley | 1e88506 | 2022-12-22 17:46:36 -0500 | [diff] [blame] | 1 | modules: |
| Tim King | 135e1ab | 2023-01-27 16:51:14 -0800 | [diff] [blame] | 2 | - module: helm.sh/helm/v3 |
| 3 | versions: |
| 4 | - fixed: 3.10.3 |
| 5 | vulnerable_at: 3.10.2 |
| 6 | packages: |
| 7 | - package: helm.sh/helm/v3/pkg/repo |
| 8 | symbols: |
| 9 | - IndexFile.MustAdd |
| 10 | - loadIndex |
| 11 | - File.Remove |
| 12 | derived_symbols: |
| 13 | - ChartRepository.DownloadIndexFile |
| 14 | - ChartRepository.Index |
| 15 | - ChartRepository.Load |
| 16 | - FindChartInAuthAndTLSAndPassRepoURL |
| 17 | - FindChartInAuthAndTLSRepoURL |
| 18 | - FindChartInAuthRepoURL |
| 19 | - FindChartInRepoURL |
| 20 | - IndexDirectory |
| 21 | - IndexFile.Add |
| 22 | - LoadIndexFile |
| Tatiana Bradley | 1e88506 | 2022-12-22 17:46:36 -0500 | [diff] [blame] | 23 | description: | |
| 24 | Applications that use the repo package in the Helm SDK to parse an index |
| 25 | file can suffer a Denial of Service when that input causes a panic that |
| 26 | cannot be recovered from. |
| 27 | |
| 28 | The repo package contains a handler that processes the index file of a |
| 29 | repository. For example, the Helm client adds references to chart |
| 30 | repositories where charts are managed. The repo package parses the index |
| 31 | file of the repository and loads it into memory. Some index files can cause |
| 32 | array data structures to be created causing a memory violation. |
| 33 | |
| 34 | The Helm Client will panic with an index file that causes a memory |
| 35 | violation panic. Helm is not a long running service so the panic will not |
| 36 | affect future uses of the Helm client. |
| 37 | cves: |
| Tim King | 135e1ab | 2023-01-27 16:51:14 -0800 | [diff] [blame] | 38 | - CVE-2022-23525 |
| Tatiana Bradley | 1e88506 | 2022-12-22 17:46:36 -0500 | [diff] [blame] | 39 | ghsas: |
| Tim King | 135e1ab | 2023-01-27 16:51:14 -0800 | [diff] [blame] | 40 | - GHSA-53c4-hhmh-vw5q |
| Tatiana Bradley | 1e88506 | 2022-12-22 17:46:36 -0500 | [diff] [blame] | 41 | credit: Ada Logics, in a fuzzing audit sponsored by CNCF |
| 42 | references: |
| Tim King | 135e1ab | 2023-01-27 16:51:14 -0800 | [diff] [blame] | 43 | - advisory: https://github.com/helm/helm/security/advisories/GHSA-53c4-hhmh-vw5q |
| 44 | - fix: https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b |
