| Tatiana Bradley | f1409b0 | 2023-05-24 14:02:12 -0400 | [diff] [blame] | 1 | id: GO-2022-1166 |
| Tatiana Bradley | 4094a08 | 2022-12-22 16:29:28 -0500 | [diff] [blame] | 2 | modules: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 3 | - module: helm.sh/helm/v3 |
| 4 | versions: |
| 5 | - fixed: 3.10.3 |
| 6 | vulnerable_at: 3.10.2 |
| 7 | packages: |
| 8 | - package: helm.sh/helm/v3/pkg/chartutil |
| 9 | symbols: |
| 10 | - ValidateAgainstSingleSchema |
| 11 | derived_symbols: |
| 12 | - ToRenderValues |
| 13 | - ValidateAgainstSchema |
| Tatiana Bradley | 6a3b20c | 2023-06-05 13:34:46 -0400 | [diff] [blame] | 14 | summary: Denial of service via schema file in helm.sh/helm/v3 |
| Tatiana Bradley | ccdac2d | 2023-06-22 13:27:05 -0400 | [diff] [blame^] | 15 | description: |- |
| 16 | Certain JSON schema validation files can cause a Helm Client to panic, leading |
| 17 | to a possible denial of service. |
| Tatiana Bradley | 4094a08 | 2022-12-22 16:29:28 -0500 | [diff] [blame] | 18 | |
| 19 | The chartutil package contains a parser that loads a JSON Schema validation |
| 20 | file. For example, the Helm client when rendering a chart will validate its |
| Tatiana Bradley | ccdac2d | 2023-06-22 13:27:05 -0400 | [diff] [blame^] | 21 | values with the schema file. The chartutil package parses the schema file and |
| 22 | loads it into memory, but some schema files can cause array data structures to |
| 23 | be created causing a memory violation. |
| Tatiana Bradley | 4094a08 | 2022-12-22 16:29:28 -0500 | [diff] [blame] | 24 | |
| 25 | The Helm Client will panic with a schema file that causes a memory violation |
| Tatiana Bradley | ccdac2d | 2023-06-22 13:27:05 -0400 | [diff] [blame^] | 26 | panic. Helm is not a long running service so the panic will not affect future |
| 27 | uses of the Helm client. |
| Tatiana Bradley | 4094a08 | 2022-12-22 16:29:28 -0500 | [diff] [blame] | 28 | cves: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 29 | - CVE-2022-23526 |
| Tatiana Bradley | 4094a08 | 2022-12-22 16:29:28 -0500 | [diff] [blame] | 30 | ghsas: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 31 | - GHSA-67fx-wx78-jx33 |
| Tatiana Bradley | 0910814 | 2023-05-18 16:23:32 -0400 | [diff] [blame] | 32 | credits: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 33 | - Ada Logics, in a fuzzing audit sponsored by CNCF |
| Tatiana Bradley | 4094a08 | 2022-12-22 16:29:28 -0500 | [diff] [blame] | 34 | references: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 35 | - advisory: https://github.com/helm/helm/security/advisories/GHSA-67fx-wx78-jx33 |
| 36 | - fix: https://github.com/helm/helm/commit/bafafa8bb1b571b61d7a9528da8d40c307dade3d |
