CVE-2024-26147 — Use of Uninitialized Variable in Helm

CWE-457 — Use of Uninitialized VariableCWE-908 — Use of Uninitialized Resource8 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 47.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
HelmHelm.sh Helm V3
Timeline
PublishedFeb 21
Latest updateJun 4

Description

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm cl…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5helm/helm< 3.14.2
▶NVDhelm/helm< 3.14.2
▶Gohelm.sh/helm_v3< 3.14.2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3↗2024-06-04
▶
OSV
Helm's Missing YAML Content Leads To Panic↗2024-02-22
▶
GHSA
Helm's Missing YAML Content Leads To Panic↗2024-02-22
▶
CVEList
Helm's Missing YAML Content Leads To Panic↗2024-02-21
▶
OSV
CVE-2024-26147: Helm is a package manager for Charts for Kubernetes↗2024-02-21
▶

📋Vendor Advisories

2
Red Hat
helm: Missing YAML Content Leads To Panic↗2024-02-22
▶
Microsoft
Helm's Missing YAML Content Leads To Panic↗2024-02-13
▶
CVE-2024-26147 — Use of Uninitialized Variable in Helm | cvebase