kubearmor-client icon indicating copy to clipboard operation
kubearmor-client copied to clipboard

Published 20 hours ago • verified publisher icon kubearmor

Update module helm.sh/helm/v3 to v3.17.3 [SECURITY]

Open renovate[bot] opened this issue 8 months ago • 1 comments

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
helm.sh/helm/v3 v3.17.0 -> v3.17.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-32386

A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-32387

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.

Impact

A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Release Notes

helm/helm (helm.sh/helm/v3)

v3.17.3: Helm v3.17.3

Compare Source

Helm v3.17.3 is a security (patch) release. Users are strongly recommended to update to this release.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Installation and Upgrading

Download Helm v3.17.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.18.0 is the next minor release and will be on May 14, 2025
Changelog
  • Unarchiving fix e4da497 (Matt Farina)

v3.17.2: Helm v3.17.2

Compare Source

Helm v3.17.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Installation and Upgrading

Download Helm v3.17.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.17.3 is the next patch release and will be on April 09, 2025
  • 3.18.0 is the next minor release and will be on May 14, 2025
Changelog
  • Updating to 0.37.0 for x/net cc0bbbd (Matt Farina)
  • build(deps): bump the k8s-io group with 7 updates ecb7a74 (dependabot[bot])

v3.17.1: Helm v3.17.1

Compare Source

Helm v3.17.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.17.1. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.17.2 is the next patch release and will be on March 12, 2025
  • 3.18.0 is the next minor release and will be on May 14, 2025

Changelog

  • add test for nullifying nested global value 980d8ac (Ryan Hockstad)
  • Add test case for removing an entire object c23e3b6 (Ryan Hockstad)
  • Tests for bugfix: Override subcharts with null values #​12879 3110d5f (Scott Rigby)
  • merge null child chart objects 9520c71 (Ryan Hockstad)
  • build(deps): bump the k8s-io group with 7 updates ab7dedd (dependabot[bot])
  • fix: check group for resource info match a2d3602 (Jiasheng Zhu)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Apr 10 '25 16:04 renovate[bot]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: install-tool golang 1.22.12

renovate[bot] avatar Apr 10 '25 16:04 renovate[bot]