SB2024120630 - SUSE update for Recommended update for helm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024120630

SB2024120630 - SUSE update for Recommended update for helm

Published: December 6, 2024

Security Bulletin ID SB2024120630
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2024-25620)

The vulnerability allows a remote user to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences when saving charts at Chart.yaml. A remote user can send a specially crafted HTTP request and overwrite arbitrary files on the system.


2) Use of uninitialized variable (CVE-ID: CVE-2024-26147)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of an uninitialized variable when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. If index.yaml file or a plugins plugin.yaml file are missing in the repository, the application crashes.


Remediation

Install update from vendor's website.

References