helm.sh/helm/v3 (Go)
Advisories
40
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.20.2 or later clears every advisory below that has a fix.
Upgrade commands
go
go get helm.sh/helm/v3@v3.20.2 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment |
Medium EPSS 0.20% |
< 3.20.2 | 3.20.2 |
| GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment |
Medium EPSS 0.20% |
< 3.20.2 | 3.20.2 |
| GHSA-f9f8-9pmf-xv68 Helm May Panic Due To Incorrect YAML Content |
Medium EPSS 0.33% |
< 3.18.5 | 3.18.5 |
| GHSA-f9f8-9pmf-xv68 Helm May Panic Due To Incorrect YAML Content |
Medium EPSS 0.33% |
< 3.18.5 | 3.18.5 |
| GHSA-9h84-qmv7-982p Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion |
Medium EPSS 0.33% |
< 3.18.5 | 3.18.5 |
| GHSA-9h84-qmv7-982p Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion |
Medium EPSS 0.33% |
< 3.18.5 | 3.18.5 |
| GHSA-557j-xg8c-q2mm Helm vulnerable to Code Injection through malicious chart.yaml content |
High EPSS 0.46% |
>= 3.18.0-rc.1, < 3.18.4 | 3.18.4 |
| GHSA-557j-xg8c-q2mm Helm vulnerable to Code Injection through malicious chart.yaml content |
High EPSS 0.46% |
< 3.17.4 | 3.17.4 |
| GHSA-557j-xg8c-q2mm Helm vulnerable to Code Injection through malicious chart.yaml content |
High EPSS 0.46% |
< 3.18.4 | 3.18.4 |
| GHSA-5xqw-8hwv-wg92 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow |
Medium EPSS 0.49% |
< 3.17.3 | 3.17.3 |
| GHSA-5xqw-8hwv-wg92 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow |
Medium EPSS 0.49% |
< 3.17.3 | 3.17.3 |
| GHSA-4hfp-h4cw-hj8p Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination |
Medium EPSS 0.46% |
< 3.17.3 | 3.17.3 |
| GHSA-4hfp-h4cw-hj8p Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination |
Medium EPSS 0.46% |
< 3.17.3 | 3.17.3 |
| GHSA-jw44-4f3j-q396 Withdrawn Advisory: Helm shows secrets in clear text Withdrawn |
Medium EPSS 0.68% |
>= 3.0.0, <= 3.14.2 | No fix yet |
| GHSA-r53h-jv2g-vpx6 Helm's Missing YAML Content Leads To Panic |
High EPSS 0.93% |
< 3.14.2 | 3.14.2 |
| GHSA-r53h-jv2g-vpx6 Helm's Missing YAML Content Leads To Panic |
High EPSS 0.93% |
< 3.14.2 | 3.14.2 |
| GHSA-v53g-5gjp-272r Helm dependency management path traversal |
Medium EPSS 0.57% |
< 3.14.1 | 3.14.1 |
| GHSA-v53g-5gjp-272r Helm dependency management path traversal |
Medium EPSS 0.57% |
< 3.14.1 | 3.14.1 |
| GHSA-pwcw-6f5g-gxf8 Helm vulnerable to information disclosure via getHostByName Function |
Medium EPSS 0.77% |
< 3.11.1 | 3.11.1 |
| GHSA-pwcw-6f5g-gxf8 Helm vulnerable to information disclosure via getHostByName Function |
Medium EPSS 0.77% |
>= 3.0.0, < 3.11.1 | 3.11.1 |
| GHSA-67fx-wx78-jx33 Helm vulnerable to denial of service through schema file |
High EPSS 0.89% |
< 3.10.3 | 3.10.3 |
| GHSA-67fx-wx78-jx33 Helm vulnerable to denial of service through schema file |
High EPSS 0.89% |
< 3.10.3 | 3.10.3 |
| GHSA-53c4-hhmh-vw5q Helm vulnerable to denial of service through through repository index file |
High EPSS 0.89% |
< 3.10.3 | 3.10.3 |
| GHSA-53c4-hhmh-vw5q Helm vulnerable to denial of service through through repository index file |
High EPSS 0.89% |
< 3.10.3 | 3.10.3 |
| GHSA-6rx9-889q-vv2r Helm vulnerable to denial of service through string value parsing |
High EPSS 0.81% |
< 3.10.3 | 3.10.3 |
| GHSA-6rx9-889q-vv2r Helm vulnerable to denial of service through string value parsing |
High EPSS 0.81% |
< 3.10.3 | 3.10.3 |
| GHSA-7hfp-qfw3-5jxh Helm Vulnerable to denial of service through string value parsing |
Medium EPSS 1.45% |
< 3.9.4 | 3.9.4 |
| GHSA-7hfp-qfw3-5jxh Helm Vulnerable to denial of service through string value parsing |
Medium EPSS 1.45% |
< 3.9.4 | 3.9.4 |
| GHSA-c38g-469g-cmgx Improper Neutralization of Special Elements in Output in helm.sh/helm/v3 |
Medium EPSS 1.09% |
>= 3.0.0, < 3.5.2 | 3.5.2 |
| GHSA-c38g-469g-cmgx Improper Neutralization of Special Elements in Output in helm.sh/helm/v3 |
Medium EPSS 1.09% |
>= 3.0.0, < 3.5.2 | 3.5.2 |
| GHSA-qq3j-xp49-j73f Plugin archive directory traversal in Helm |
Low EPSS 1.46% |
>= 3.0.0, < 3.2.4 | 3.2.4 |
| GHSA-56hp-xqp3-w2jf Helm passes repository credentials to alternate domain |
Medium EPSS 1.43% |
< 3.6.1 | 3.6.1 |
| GHSA-56hp-xqp3-w2jf Helm passes repository credentials to alternate domain |
Medium EPSS 1.43% |
< 3.6.1 | 3.6.1 |
| GHSA-56hp-xqp3-w2jf Helm passes repository credentials to alternate domain |
Medium EPSS 1.43% |
< 3.6.1 | 3.6.1 |
| GHSA-cjjc-xp8v-855w Helm uses crypto package vulnerable to panic from malformed X.509 certificate |
High EPSS 2.65% |
>= 3.0.0, < 3.1.0 | 3.1.0 |
| GHSA-q8q8-93cv-v6h8 Lookup function information discolosure in helm |
High EPSS 1.41% |
>= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-c52f-pq47-2r9j plugin.yaml file allows for duplicate entries in helm |
Low EPSS 1.52% |
>= 3.0.0, < 3.3.2 | 3.3.2 |
| GHSA-m54r-vrmv-hw33 Improper Sanitizing of plugin names in helm |
Low EPSS 0.96% |
>= 3.0.0, < 3.3.2 | 3.3.2 |
| GHSA-jm56-5h66-w453 Repository index file allows for duplicates of the same chart entry in helm |
Low EPSS 0.88% |
>= 3.0.0, < 3.3.2 | 3.3.2 |
| GHSA-9vp5-m38w-j776 Aliases are never checked in helm |
Low EPSS 1.03% |
>= 3.0.0, < 3.3.2 | 3.3.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor