A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.
ImpactThere are two areas of YAML validation that were impacted. First, when a Chart.yaml
file had a null
maintainer or the child
or parent
of a dependencies import-values
could be parsed as something other than a string, helm lint
would panic. Second, when an index.yaml
had an empty entry in the list of chart versions Helm would panic on interactions with that repository.
This issue has been resolved in Helm v3.18.5.
WorkaroundsEnsure YAML files are formatted as Helm expects prior to processing them with Helm.
ReferencesHelm's security policy is spelled out in detail in our SECURITY document.
CreditsDisclosed by Jakub Ciolek at AlphaSense.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4