Missing YAML Content Leads To Panic
CVE: CVE-2024-26147
Component: helm
CWE: CWE-457
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-02-22T00:00:00+00:00

A vulnerability was found in Helm. This flaw may lead to a panic when Helm parses index and plugin yaml files missing expected content, leading to a denial of service.

Statement: Red Hat rates this as Moderate since this would impact the Helm client and requires a malicious plugin to be in place, which can be removed.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/install/index#installing
If you are using an earlier version of RHACS 4.3, you are advised to upgrade to patch release 4.3.6.
If you are using an earlier version of RHACS, you are advised to upgrade to release 4.4.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:8ba5619d0cd45f27ab5f6ec4ff098620719871368b776190e77764a72b5d49b1

      (For s390x architecture)
      The image digest is sha256:e72a83e935fe3a40d64937bcea300ae360d19e16f81ce722bf2334c23a2a1a7e

      (For ppc64le architecture)
      The image digest is sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d

      (For aarch64 architecture)
      The image digest is sha256:91b376eaf1bc845e5f32befcee70fe48fcf3acc2412208ffe930de536f8d671c

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:29d88fadd452261fc8a0bbbb5d920a7fe5b8b7a0050f673a7c47059f03daef28

      (For s390x architecture)
      The image digest is sha256:59557a8caba9c7f7e1fe4b39545d1aa33d12ed9e6b4ff1f118b0ae16087ac577

      (For ppc64le architecture)
      The image digest is sha256:890a9bc6f7f9c65e6d98d677085228b462a00c096afd08082f4a7f56441679bc

      (For aarch64 architecture)
      The image digest is sha256:7dd6c863983390d4a975c7a01ce12eabbe1bed9fee07d36faa000e98f3cc9e73

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:234ccdfa4adabcfa7490785bad7108a3c7d622f19cd5b8f4b241dfba96c09be0

      (For s390x architecture)
      The image digest is sha256:b2d858845c618265e67fa36952062ca23a8509824ff9abde5fa04e74808d103d

      (For ppc64le architecture)
      The image digest is sha256:7dfd403f5fb3ae023eee7a308673d42d33ee73340aa95dd785a864189ede7aab

      (For aarch64 architecture)
      The image digest is sha256:aae6348dbf5138c9bb7fa3ba389adf53dd865969ecf4088f423ade6468615c2e

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:c17d4489c1b283ee71c76dda559e66a546e16b208a57eb156ef38fb30098903a

      (For s390x architecture)
      The image digest is sha256:b24f28935370ec725cc326cf2cea24b0996b57552cfd009bed00314e4d8f0d2a

      (For ppc64le architecture)
      The image digest is sha256:ac0d87fc7c9a78d68d0111fc061d5599e6d46a90fea4f8360f70ab1f0cd36d82

      (For aarch64 architecture)
      The image digest is sha256:819d7a86c4280cde30d59b44d4b6abafb5e12f65c4b2d2ee604581547ba2e4b1

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.