| Package | Affected versions | Patched versions |
|---|---|---|
| helm.sh/helm | all versions | |
| helm.sh/helm/v3 | < 3.18.5 | 3.18.5 |
| helm | < 3.18.5 | 3.18.5 |
A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.
A malicious chart can point $ref in values.schema.json to a device (e.g. /dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.
This issue has been resolved in Helm v3.18.5.
Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of $ref pointing to /dev/zero.
Helm's security policy is spelled out in detail in our SECURITY document.
Disclosed by Jakub Ciolek at AlphaSense.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free