SUSE-SU-2025:21043-1: moderate: Security update for helm
SLE-SECURITY-UPDATES
null at suse.de
Thu Nov 27 13:20:22 UTC 2025
# Security update for helm
Announcement ID: SUSE-SU-2025:21043-1
Release Date: 2025-11-14T08:47:58Z
Rating: moderate
References:
* bsc#1251442
* bsc#1251649
Cross-References:
* CVE-2025-47911
* CVE-2025-58190
CVSS scores:
* CVE-2025-47911 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58190 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products:
* SUSE Linux Micro 6.0
An update that solves two vulnerabilities can now be installed.
## Description:
This update for helm fixes the following issues:
Update to version 3.19.1 (bsc#1251649, CVE-2025-58190, bsc#1251442,
CVE-2025-47911):
* chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29
* jsonschema: warn and ignore unresolved URN $ref to match v3.18.4
* Avoid "panic: interface conversion: interface {} is nil"
* Fix `helm pull` untar dir check with repo urls
* chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
* Add timeout flag to repo add and update flags
* chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.43.0
Update to version 3.19.0:
* fix: use username and password if provided
* chore(deps): bump the k8s-io group with 7 updates
* chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1
* chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1
* chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0
* fix(helm-lint): fmt
* fix(helm-lint): Add TLSClientConfig
* fix(helm-lint): Add HTTP/HTTPS URL support for json schema references
* chore(deps): bump the k8s-io group with 7 updates
* fix: go mod tidy for v3
* chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.41.0
* chore(deps): bump golang.org/x/term from 0.33.0 to 0.34.0
* fix Chart.yaml handling
* Handle messy index files
* chore(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.28
* json schema fix
* fix: k8s version parsing to match original
* chore(deps): bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0
* Do not explicitly set SNI in HTTPGetter
* chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7
* chore(deps): bump the k8s-io group with 7 updates
* chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0
* chore(deps): bump golang.org/x/term from 0.32.0 to 0.33.0
* chore(deps): bump golang.org/x/text from 0.26.0 to 0.27.0
* Disabling linter due to unknown issue
* Updating link handling
* Bump github.com/Masterminds/semver/v3 from 3.3.0 to 3.3.1
* build(deps): bump the k8s-io group with 7 updates
* build(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0
* fix: user username password for login
* Update pkg/registry/transport.go
* Update pkg/registry/transport.go
* fix: add debug logging to oci transport
* build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0
* build(deps): bump golang.org/x/text from 0.25.0 to 0.26.0
* fix: legacy docker support broken for login
* fix: plugin installer test with no Internet
* Handle an empty registry config file.
* Prevent fetching newReference again as we have in calling method
* Prevent failure when resolving version tags in oras memory store
* fix(client): skipnode utilization for PreCopy
* test: Skip instead of returning early. looks more intentional
* test: tests repo stripping functionality
* test: include tests for Login based on different protocol prefixes
* fix(client): layers now returns manifest - remove duplicate from descriptors
* fix(client): return nil on non-allowed media types
* Fix 3.18.0 regression: registry login with scheme
* Update pkg/plugin/plugin.go
* Update pkg/plugin/plugin.go
* Wait for Helm v4 before raising when platformCommand and Command are set
* Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]"
* build(deps): bump the k8s-io group with 7 updates
* chore: update generalization warning message
* build(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
* build(deps): bump the k8s-io group with 7 updates
* build(deps): bump golang.org/x/crypto from 0.37.0 to 0.38.0
* fix: move warning to top of block
* fix: govulncheck workflow
* fix: replace fmt warning with slog
* fix: add warning when ignore repo flag
* bump version to v3.18.0
* backport #30673 to dev-v3
* feat: add httproute from gateway-api to create chart template
Update to version 3.18.6:
* fix(helm-lint): Add TLSClientConfig
* fix(helm-lint): Add HTTP/HTTPS URL support for json schema references
Update to version 3.18.5:
* fix Chart.yaml handling 7799b48 (Matt Farina)
* Handle messy index files dd8502f (Matt Farina)
* json schema fix cb8595b (Robert Sirchia)
Fix shell completion dependencies
* Add BuildRequires to prevent inclusion of folders owned by shells.
* Add Requires because installing completions without appropriate shell is
questionable.
* Fix zsh completion location
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.0
zypper in -t patch SUSE-SLE-Micro-6.0-520=1
## Package List:
* SUSE Linux Micro 6.0 (aarch64 s390x x86_64)
* helm-debuginfo-3.19.1-1.1
* helm-3.19.1-1.1
* SUSE Linux Micro 6.0 (noarch)
* helm-bash-completion-3.19.1-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-47911.html
* https://www.suse.com/security/cve/CVE-2025-58190.html
* https://bugzilla.suse.com/show_bug.cgi?id=1251442
* https://bugzilla.suse.com/show_bug.cgi?id=1251649
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20251127/50569eae/attachment.htm>
More information about the sle-security-updates
mailing list