helm / community

Helm community content
https://helm.sh
421 stars 179 forks source link

Security issue in latest helm binary (v3.15.3) #357

Open vr2388 opened 3 months ago

vr2388 commented 3 months ago

I am using helm binary as part of my docker image and when I scan the image I found 1 CRITICAL security vulnerability in helm binary


=============================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

┌──────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬─────────────────────────┬────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │  Installed Version   │      Fixed Version      │                   Title                    │
├──────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼─────────────────────────┼────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2024-41110 │ CRITICAL │ fixed  │ v25.0.5+incompatible │ 23.0.14, 26.1.4, 27.1.0 │ moby: Authz zero length regression         │
│                          │                │          │        │                      │                         │ https://avd.aquasec.com/nvd/cve-2024-41110 │
└──────────────────────────┴────────────────┴──────────┴────────┴──────────────────────┴─────────────────────────┴────────────────────────────────────────────┘```

And also i found same issue while scanning the helm binary with **govulncheck** binary

```=== Symbol Results ===

Vulnerability #1: GO-2024-3005
    Moby authz zero length regression in github.com/moby/moby
  More info: https://pkg.go.dev/vuln/GO-2024-3005
  Module: github.com/docker/docker
    Found in: github.com/docker/docker@v25.0.5+incompatible
    Fixed in: github.com/docker/docker@v25.0.6+incompatible
    Vulnerable symbols found:
      #1: authorization.Ctx.AuthZRequest
      #2: authorization.Ctx.AuthZResponse```

Can you please help me in fixing this issue
banjoh commented 3 months ago

Please raise this issue https://github.com/helm/helm/issues