Security update for helm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:1571-1 Final 1 1 2023-03-24T12:45:17Z current 2023-03-24T12:45:17Z 2023-03-24T12:45:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for helm This update for helm fixes the following issues: Update to version 3.11.1 (bsc#1208084): - CVE-2023-25165: Fixed a information disclosure problem via getHostByName injection inside a chart to get values to a malicious DNS server. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/helm:latest-2023-1571,Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-2023-1571,Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-EC2-2023-1571,SUSE-2023-1571,SUSE-SLE-Module-Containers-15-SP4-2023-1571,SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-1571,openSUSE-SLE-15.4-2023-1571 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20231571-1/ Link for SUSE-SU-2023:1571-1 https://lists.suse.com/pipermail/sle-security-updates/2023-March/014157.html E-Mail link for SUSE-SU-2023:1571-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1208084 SUSE Bug 1208084 https://www.suse.com/security/cve/CVE-2023-25165/ SUSE CVE CVE-2023-25165 page Container suse/helm:latest Image SLES15-SP4-SUSE-Rancher-Setup-BYOS Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-EC2 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP4 openSUSE Leap 15.4 helm-3.11.1-150000.1.16.1 helm-bash-completion-3.11.1-150000.1.16.1 helm-fish-completion-3.11.1-150000.1.16.1 helm-zsh-completion-3.11.1-150000.1.16.1 helm-3.11.1-150000.1.16.1 as a component of Container suse/helm:latest helm-3.11.1-150000.1.16.1 as a component of Image SLES15-SP4-SUSE-Rancher-Setup-BYOS helm-3.11.1-150000.1.16.1 as a component of Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-EC2 helm-3.11.1-150000.1.16.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 helm-bash-completion-3.11.1-150000.1.16.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 helm-zsh-completion-3.11.1-150000.1.16.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 helm-fish-completion-3.11.1-150000.1.16.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 helm-3.11.1-150000.1.16.1 as a component of openSUSE Leap 15.4 helm-bash-completion-3.11.1-150000.1.16.1 as a component of openSUSE Leap 15.4 helm-fish-completion-3.11.1-150000.1.16.1 as a component of openSUSE Leap 15.4 helm-zsh-completion-3.11.1-150000.1.16.1 as a component of openSUSE Leap 15.4 Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers. CVE-2023-25165 Container suse/helm:latest:helm-3.11.1-150000.1.16.1 Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-EC2:helm-3.11.1-150000.1.16.1 Image SLES15-SP4-SUSE-Rancher-Setup-BYOS:helm-3.11.1-150000.1.16.1 SUSE Linux Enterprise Module for Containers 15 SP4:helm-3.11.1-150000.1.16.1 SUSE Linux Enterprise Module for Containers 15 SP4:helm-bash-completion-3.11.1-150000.1.16.1 SUSE Linux Enterprise Module for Containers 15 SP4:helm-zsh-completion-3.11.1-150000.1.16.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:helm-fish-completion-3.11.1-150000.1.16.1 openSUSE Leap 15.4:helm-3.11.1-150000.1.16.1 openSUSE Leap 15.4:helm-bash-completion-3.11.1-150000.1.16.1 openSUSE Leap 15.4:helm-fish-completion-3.11.1-150000.1.16.1 openSUSE Leap 15.4:helm-zsh-completion-3.11.1-150000.1.16.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231571-1/ https://www.suse.com/security/cve/CVE-2023-25165.html CVE-2023-25165 https://bugzilla.suse.com/1208083 SUSE Bug 1208083