SUSE alert SUSE-SU-2025:21043-1 (helm)
| From: | SLE-SECURITY-UPDATES <null@suse.de> | |
| To: | sle-security-updates@lists.suse.com | |
| Subject: | SUSE-SU-2025:21043-1: moderate: Security update for helm | |
| Date: | Thu, 27 Nov 2025 13:20:22 -0000 | |
| Message-ID: | <176424962202.15716.765303522050912026@smelt2.prg2.suse.org> |
# Security update for helm Announcement ID: SUSE-SU-2025:21043-1 Release Date: 2025-11-14T08:47:58Z Rating: moderate References: * bsc#1251442 * bsc#1251649 Cross-References: * CVE-2025-47911 * CVE-2025-58190 CVSS scores: * CVE-2025-47911 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-58190 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * SUSE Linux Micro 6.0 An update that solves two vulnerabilities can now be installed. ## Description: This update for helm fixes the following issues: Update to version 3.19.1 (bsc#1251649, CVE-2025-58190, bsc#1251442, CVE-2025-47911): * chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 * jsonschema: warn and ignore unresolved URN $ref to match v3.18.4 * Avoid "panic: interface conversion: interface {} is nil" * Fix `helm pull` untar dir check with repo urls * chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 * Add timeout flag to repo add and update flags * chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.43.0 Update to version 3.19.0: * fix: use username and password if provided * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 * chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 * chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 * fix(helm-lint): fmt * fix(helm-lint): Add TLSClientConfig * fix(helm-lint): Add HTTP/HTTPS URL support for json schema references * chore(deps): bump the k8s-io group with 7 updates * fix: go mod tidy for v3 * chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.41.0 * chore(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 * fix Chart.yaml handling * Handle messy index files * chore(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.28 * json schema fix * fix: k8s version parsing to match original * chore(deps): bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 * Do not explicitly set SNI in HTTPGetter * chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 * chore(deps): bump golang.org/x/term from 0.32.0 to 0.33.0 * chore(deps): bump golang.org/x/text from 0.26.0 to 0.27.0 * Disabling linter due to unknown issue * Updating link handling * Bump github.com/Masterminds/semver/v3 from 3.3.0 to 3.3.1 * build(deps): bump the k8s-io group with 7 updates * build(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 * fix: user username password for login * Update pkg/registry/transport.go * Update pkg/registry/transport.go * fix: add debug logging to oci transport * build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0 * build(deps): bump golang.org/x/text from 0.25.0 to 0.26.0 * fix: legacy docker support broken for login * fix: plugin installer test with no Internet * Handle an empty registry config file. * Prevent fetching newReference again as we have in calling method * Prevent failure when resolving version tags in oras memory store * fix(client): skipnode utilization for PreCopy * test: Skip instead of returning early. looks more intentional * test: tests repo stripping functionality * test: include tests for Login based on different protocol prefixes * fix(client): layers now returns manifest - remove duplicate from descriptors * fix(client): return nil on non-allowed media types * Fix 3.18.0 regression: registry login with scheme * Update pkg/plugin/plugin.go * Update pkg/plugin/plugin.go * Wait for Helm v4 before raising when platformCommand and Command are set * Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]" * build(deps): bump the k8s-io group with 7 updates * chore: update generalization warning message * build(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0 * build(deps): bump the k8s-io group with 7 updates * build(deps): bump golang.org/x/crypto from 0.37.0 to 0.38.0 * fix: move warning to top of block * fix: govulncheck workflow * fix: replace fmt warning with slog * fix: add warning when ignore repo flag * bump version to v3.18.0 * backport #30673 to dev-v3 * feat: add httproute from gateway-api to create chart template Update to version 3.18.6: * fix(helm-lint): Add TLSClientConfig * fix(helm-lint): Add HTTP/HTTPS URL support for json schema references Update to version 3.18.5: * fix Chart.yaml handling 7799b48 (Matt Farina) * Handle messy index files dd8502f (Matt Farina) * json schema fix cb8595b (Robert Sirchia) Fix shell completion dependencies * Add BuildRequires to prevent inclusion of folders owned by shells. * Add Requires because installing completions without appropriate shell is questionable. * Fix zsh completion location ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-520=1 ## Package List: * SUSE Linux Micro 6.0 (aarch64 s390x x86_64) * helm-debuginfo-3.19.1-1.1 * helm-3.19.1-1.1 * SUSE Linux Micro 6.0 (noarch) * helm-bash-completion-3.19.1-1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-47911.html * https://www.suse.com/security/cve/CVE-2025-58190.html * https://bugzilla.suse.com/show_bug.cgi?id=1251442 * https://bugzilla.suse.com/show_bug.cgi?id=1251649
Attachment: None (type=text/html)
(HTML attachment elided)