SUSE-SU-2025:02121-1: important: Security update for helm
SLE-UPDATES
null at suse.de
Thu Jun 26 12:31:11 UTC 2025
# Security update for helm
Announcement ID: SUSE-SU-2025:02121-1
Release Date: 2025-06-26T08:34:33Z
Rating: important
References:
* bsc#1241802
Cross-References:
* CVE-2025-22872
CVSS scores:
* CVE-2025-22872 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
* CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-22872 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected Products:
* Containers Module 15-SP6
* Containers Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP6
* SUSE Package Hub 15 15-SP7
An update that solves one vulnerability can now be installed.
## Description:
This update for helm fixes the following issues:
Update to version 3.18.3:
* build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0 6838ebc
(dependabot[bot])
* fix: user username password for login 5b9e2f6 (Terry Howe)
* Update pkg/registry/transport.go 2782412 (Terry Howe)
* Update pkg/registry/transport.go e66cf6a (Terry Howe)
* fix: add debug logging to oci transport 191f05c (Terry Howe)
Update to version 3.18.2:
* fix: legacy docker support broken for login 04cad46 (Terry Howe)
* Handle an empty registry config file. bc9f8a2 (Matt Farina)
Update to version 3.18.1:
* Notes:
* This release fixes regressions around template generation and OCI registry interaction in 3.18.0
* There are at least 2 known regressions unaddressed in this release. They are being worked on.
* Empty registry configuration files. When the file exists but it is empty.
* Login to Docker Hub on some domains fails.
* Changelog
* fix(client): skipnode utilization for PreCopy
* fix(client): layers now returns manifest - remove duplicate from descriptors
* fix(client): return nil on non-allowed media types
* Prevent fetching newReference again as we have in calling method
* Prevent failure when resolving version tags in oras memory store
* Update pkg/plugin/plugin.go
* Update pkg/plugin/plugin.go
* Wait for Helm v4 before raising when platformCommand and Command are set
* Fix 3.18.0 regression: registry login with scheme
* Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]"
Update to version 3.18.0 (bsc#1241802, CVE-2025-22872):
* Notable Changes
* Add support for JSON Schema 2020
* Enabled cpu and memory profiling
* Add hook annotation to output hook logs to client on error
* Changelog
* build(deps): bump the k8s-io group with 7 updates
* fix: govulncheck workflow
* bump version to v3.18.0
* fix:add proxy support when mTLS configured
* docs: Note about http fallback for OCI registries
* Bump net package to avoid CVE on dev-v3
* Bump toml
* backport #30677to dev3
* build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to 1.8.0
* Add install test for TakeOwnership flag
* Fix --take-ownership
* build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to 1.7.2
* build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0
* build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0
* Testing text bump
* Permit more Go version and not only 1.23.8
* Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3 to 3.0.0
* Unarchiving fix
* Fix typo
* Report as debug log, the time spent waiting for resources
* build(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27
* Update pkg/registry/fallback.go
* automatic fallback to http
* chore(oci): upgrade to ORAS v2
* Updating to 0.37.0 for x/net
* build(deps): bump the k8s-io group with 7 updates
* build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0
* build(deps): bump github.com/opencontainers/image-spec
* build(deps): bump github.com/containerd/containerd from 1.7.25 to 1.7.26
* build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0
* Fix cherry-pick helm.sh/helm/v4 -> helm.sh/helm/v3
* Add HookOutputFunc and generic yaml unmarshaller
* clarify fix error message
* fix err check
* add short circuit return
* Add hook annotations to output pod logs to client on success and fail
* chore: use []error instead of []string
* Update cmd/helm/profiling.go
* chore: update profiling doc in CONTRIBUTING.md
* Update CONTRIBUTING guide
* Prefer environment variables to CLI flags
* Move pprof paths to HELM_PPROF env variable
* feat: Add flags to enable CPU and memory profiling
* build(deps): bump github.com/distribution/distribution/v3
* build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1
* Moving to SetOut and SetErr for Cobra
* build(deps): bump the k8s-io group with 7 updates
* build(deps): bump golang.org/x/crypto from 0.32.0 to 0.33.0
* build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0
* build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0
* build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6
* build(deps): bump github.com/cyphar/filepath-securejoin
* build(deps): bump github.com/evanphx/json-patch
* build(deps): bump the k8s-io group with 7 updates
* fix: check group for resource info match
* Bump github.com/cyphar/filepath-securejoin from 0.3.6 to 0.4.0
* add test for nullifying nested global value
* Ensuring the file paths are clean prior to passing to securejoin
* Bump github.com/containerd/containerd from 1.7.24 to 1.7.25
* Bump golang.org/x/crypto from 0.31.0 to 0.32.0
* Bump golang.org/x/term from 0.27.0 to 0.28.0
* bump version to v3.17.0
* Bump github.com/moby/term from 0.5.0 to 0.5.2
* Add test case for removing an entire object
* Tests for bugfix: Override subcharts with null values #12879
* feat: Added multi-platform plugin hook support to v3
* This commit fixes the issue where the yaml.Unmarshaller converts all int values into float64, this passes in option to decoder, which enables conversion of int into .
* merge null child chart objects
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-2121=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2025-2121=1
* Containers Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2025-2121=1
* Containers Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Containers-15-SP7-2025-2121=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-2121=1
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-2121=1
## Package List:
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* helm-3.18.3-150000.1.50.1
* helm-debuginfo-3.18.3-150000.1.50.1
* openSUSE Leap 15.6 (noarch)
* helm-fish-completion-3.18.3-150000.1.50.1
* helm-bash-completion-3.18.3-150000.1.50.1
* helm-zsh-completion-3.18.3-150000.1.50.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)
* helm-3.18.3-150000.1.50.1
* helm-debuginfo-3.18.3-150000.1.50.1
* SUSE Linux Enterprise Micro 5.5 (noarch)
* helm-bash-completion-3.18.3-150000.1.50.1
* Containers Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* helm-3.18.3-150000.1.50.1
* helm-debuginfo-3.18.3-150000.1.50.1
* Containers Module 15-SP6 (noarch)
* helm-zsh-completion-3.18.3-150000.1.50.1
* helm-bash-completion-3.18.3-150000.1.50.1
* Containers Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* helm-3.18.3-150000.1.50.1
* helm-debuginfo-3.18.3-150000.1.50.1
* Containers Module 15-SP7 (noarch)
* helm-zsh-completion-3.18.3-150000.1.50.1
* helm-bash-completion-3.18.3-150000.1.50.1
* SUSE Package Hub 15 15-SP6 (noarch)
* helm-fish-completion-3.18.3-150000.1.50.1
* SUSE Package Hub 15 15-SP7 (noarch)
* helm-fish-completion-3.18.3-150000.1.50.1
## References:
* https://www.suse.com/security/cve/CVE-2025-22872.html
* https://bugzilla.suse.com/show_bug.cgi?id=1241802
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20250626/6d4f42ae/attachment.htm>
More information about the sle-updates
mailing list