diff --git a/advisories/github-reviewed/2025/04/GHSA-4hfp-h4cw-hj8p/GHSA-4hfp-h4cw-hj8p.json b/advisories/github-reviewed/2025/04/GHSA-4hfp-h4cw-hj8p/GHSA-4hfp-h4cw-hj8p.json new file mode 100644 index 00000000000..22d9cf59421 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-4hfp-h4cw-hj8p/GHSA-4hfp-h4cw-hj8p.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4hfp-h4cw-hj8p", + "modified": "2025-04-10T13:48:05Z", + "published": "2025-04-10T13:48:05Z", + "aliases": [ + "CVE-2025-32386" + ], + "summary": "Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination", + "details": "A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination.\n\n### Impact\nA chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate.\n\n### Patches\nThis issue has been resolved in Helm v3.17.3.\n\n### Workarounds\nEnsure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.\n\n### For more information\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\nDisclosed by Jakub Ciolek at AlphaSense.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "helm.sh/helm/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.17.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/helm/helm/security/advisories/GHSA-4hfp-h4cw-hj8p" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32386" + }, + { + "type": "WEB", + "url": "https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/helm/helm" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770", + "CWE-789" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-10T13:48:05Z", + "nvd_published_at": "2025-04-09T23:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-5xqw-8hwv-wg92/GHSA-5xqw-8hwv-wg92.json b/advisories/github-reviewed/2025/04/GHSA-5xqw-8hwv-wg92/GHSA-5xqw-8hwv-wg92.json new file mode 100644 index 00000000000..1882e7fc253 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-5xqw-8hwv-wg92/GHSA-5xqw-8hwv-wg92.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xqw-8hwv-wg92", + "modified": "2025-04-10T13:48:31Z", + "published": "2025-04-10T13:48:31Z", + "aliases": [ + "CVE-2025-32387" + ], + "summary": "Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow", + "details": "A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.\n\n### Impact\nA JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. \n\n### Patches\nThis issue has been resolved in Helm v3.17.3.\n\n### Workarounds\nEnsure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.\n\n### For more information\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\nDisclosed by Jakub Ciolek at AlphaSense.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "helm.sh/helm/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.17.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/helm/helm/security/advisories/GHSA-5xqw-8hwv-wg92" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32387" + }, + { + "type": "WEB", + "url": "https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/helm/helm" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121", + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-10T13:48:31Z", + "nvd_published_at": "2025-04-09T23:15:37Z" + } +} \ No newline at end of file