SUSE-SU-2026:24282-1

SUSE-SU-2026:24282-1 · Security update for helm

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758). - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939). - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935). - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938). - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327). - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024). - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104). - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468). - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514). Changes for helm: - update to 4.3.0: * feat: Add duration functions * feat(engine): add debug logging when lookup returns empty * feat: add ownership verification before deleting resources * feat: honor SOURCE_DATE_EPOCH for chart archives * feat(rollback): add --description flag to provide rollback reason * fix (internal/plugin): remove zero-width spaces from plugin name comment * fix(loader): do not drop values files ending at a 4096-byte boundary * fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings * fix(template): regression - route registry messages to stderr in template and show * refactor: lower resync period from one hour to 3 minutes * perf: enable concurrent status computation to prevent multi-minute delays * fix: Improve error reporting for helm template --debug with --show-only- #31185 * fix: fetch logs from all containers in test pods- #32099 * fix(provenance): check error return in Digest and encodeRelease- #32136 * fix panic on repeated IsReachable calls- #32184 * fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 * Fix missing conflict retry with server-side apply- #32088 * Properly format the extra field in gzipped packages- #31884 * Fix vanishing empty lines- #32327 * fix: pass registry client to downloader.Manager in upgrade- #32400 * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- #32450 * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe) * bump golang.org/x/text to v.0.40.0 * Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214 * Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925 * Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056 * Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757 * Fixed a race condition in WaitForDelete where the status failures when running a full test suite #32081 #32153 * Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128 * Dependency updates * Bump to version v4.2 0646808 (George Jenkins) * build: Clean up Goreleaser change (#32098) e23bf3a (Scott Rigby) * fix: add -extldflags -static to dist target to match build-cross f60ab7c (Terry Howe) * build: use goreleaser build with manual archive creation 64aa46f (Terry Howe) * chore: remove build-cross dependency from test-acceptance d199a1a (Terry Howe) * ci: add fetch-depth 0 to canary checkout for goreleaser 8289940 * fix: address goreleaser build issues flagged in review c075022 (Terry Howe) * fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd (Terry Howe) * fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce (Terry Howe) * fix: use index for optional env var in version_template e49a1dc * fix: canary build file names eaa0910 (Terry Howe) * Fix archive name 5a75279 (Terry Howe) * fix goreleaser archive 37284a9 (Terry Howe) * add support for loong64 45336cc (Terry Howe) * fix artifact directory a9659b0 (Terry Howe) * update configuration to v2 e368f17 (Terry Howe) * remove GOTOOLCHAIN e7bea85 (Terry Howe) * chore: replace mitchellh/gox with goreleaser 075c096 (Terry Howe) * chore(deps): bump github.com/distribution/distribution/v3 12f2c41 (dependabot[bot]) * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffd (dependabot[bot]) * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfb (dependabot[bot]) * Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df (Matheus Pimenta) * fix: adds topLevel permissions to improve openSSF scores 277d970 (Gagan H R) * Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7 * fix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24 (Matheus Pimenta) * docs: fix grammar and spacing in CONTRIBUTING.md db40adb (Mohit) * chore(deps): bump the k8s-io group with 7 updates 775e794 (dependabot[bot]) * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace3 (dependabot[bot]) * fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb (Matheus Pimenta) * chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7d (dependabot[bot]) * Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai) * test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971 (Johannes Lohmer) * fix(values): do not copy chart-default nils into coalesced values 0063877 (Johannes Lohmer) * test(values): add test for subchart nil producing %!s() 6eb4ebf (Johannes Lohmer) * test(values): add tests for subchart nil value regressions 5cb4e7d (Johannes Lohmer) * chore(deps): bump actions/upload-artifact fro

Correctif disponible

Publication

2026-10-19T09:48:48Z

Mise à jour

2026-10-27T17:23:10.855975840Z

Pile logicielle: system

Vérifiez votre serveur →