# Recommended update for helm Announcement ID: SUSE-RU-2024:4213-1 Release Date: 2024-12-05T16:06:20Z Rating: moderate References: * bsc#1219969 * bsc#1220207 * jsc#MSC-899 * jsc#SMO-479 Cross-References: * CVE-2024-25620 * CVE-2024-26147 CVSS scores: * CVE-2024-25620 ( SUSE ): 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N * CVE-2024-26147 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Containers Module 15-SP5 * Containers Module 15-SP6 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * openSUSE Leap Micro 5.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that solves two vulnerabilities and contains two features can now be installed. ## Description: helm was updated to fix the following issues: Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions #13176 * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes \- added sha512sum template function \- added ActiveHelp for cmds that don't take any more args \- drops very old Kubernetes versions support in helm create \- add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' \- fixed bug to now use burst limit setting for discovery \- Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker * * * Thu Jul 11 05:39:32 UTC 2024 - opensuse_buildservice@ojkastl.de * Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock Update to version 3.15.1: * Fixing build issue where wrong version is used Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * Updating .gitignore 8b424ba (Robert Sirchia) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * Update architecture detection method 57a1bb8 (weidongkl) * Improve release action 4790bb9 (George Jenkins) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * Update architecture detection method Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix Update to version 3.14.0: * Notable Changes * New helm search flag of --fail-on-no-result * Allow a nested tpl invocation access to defines * Speed up the tpl function * Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate * Added --kube-version to lint command * The ignore pkg is now public * Changelog * Improve release action * Fix issues when verify generation readiness was merged * fix test to use the default code's k8sVersionMinor * lint: Add --kube-version flag to set capabilities and deprecation rules * Removing Asset Transparency * tests(pkg/engine): test RenderWithClientProvider * Make the `ignore` pkg public again * feature(pkg/engine): introduce RenderWithClientProvider * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * Update CONTRIBUTING.md * Fixing release labelling in rollback * feat: move livenessProbe and readinessProbe values to default values file * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * Update get-helm-3 * Drop filterSystemLabels usage from Query method * Apply review suggestions * Update get-helm-3 to get version through get.helm.sh * feat: print failed hook name * Fixing precedence issue with the import of values. * chore(create): indent to spaces * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * remove useless print during prepareUpgrade * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): address anonymous pull issue * fix(registry): unswallow error * Fix missing run statement on release action * Add qps/HELM_QPS parameter * Write latest version to get.helm.sh bucket * Increased release information key name max length. * Pin gox to specific commit * Remove `GoFish` from package managers for installing the binary * Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" * Test update for "Speed up `tpl`" * Add support for RISC-V * lint and validate dependency metadata to reference dependencies with a unique key (name or alias) * Work around template.Clone omitting options * fix: pass 'passCredentialsAll' as env-var to getter * feat: pass basic auth to env-vars when running download plugins * helm search: New CLI Flag --fail-on-no-result * Update pkg/kube/ready.go * fix post install hook deletion due to before-hook-creation policy * Allow a nested `tpl` invocation access to `defines` in a containing one * Remove the 'reference templates' concept * Speed up `tpl` * ready checker- comment update * ready checker- remove duplicate statefulset generational check * Verify generation in readiness checks * feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap Micro 5.5 zypper in -t patch openSUSE-Leap-Micro-5.5-2024-4213=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-4213=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-4213=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-4213=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-4213=1 * Containers Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2024-4213=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-4213=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-4213=1 ## Package List: * openSUSE Leap Micro 5.5 (aarch64 ppc64le s390x x86_64) * helm-debuginfo-3.16.3-150000.1.38.1 * helm-3.16.3-150000.1.38.1 * openSUSE Leap Micro 5.5 (noarch) * helm-zsh-completion-3.16.3-150000.1.38.1 * helm-bash-completion-3.16.3-150000.1.38.1 * helm-fish-completion-3.16.3-150000.1.38.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * helm-debuginfo-3.16.3-150000.1.38.1 * helm-3.16.3-150000.1.38.1 * openSUSE Leap 15.5 (noarch) * helm-zsh-completion-3.16.3-150000.1.38.1 * helm-bash-completion-3.16.3-150000.1.38.1 * helm-fish-completion-3.16.3-150000.1.38.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * helm-debuginfo-3.16.3-150000.1.38.1 * helm-3.16.3-150000.1.38.1 * openSUSE Leap 15.6 (noarch) * helm-zsh-completion-3.16.3-150000.1.38.1 * helm-bash-completion-3.16.3-150000.1.38.1 * helm-fish-completion-3.16.3-150000.1.38.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * helm-debuginfo-3.16.3-150000.1.38.1 * helm-3.16.3-150000.1.38.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * helm-bash-completion-3.16.3-150000.1.38.1 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * helm-debuginfo-3.16.3-150000.1.38.1 * helm-3.16.3-150000.1.38.1 * Containers Module 15-SP5 (noarch) * helm-zsh-completion-3.16.3-150000.1.38.1 * helm-bash-completion-3.16.3-150000.1.38.1 * Containers Module 15-SP6 (aarch64 ppc64le s390x x86_64) * helm-debuginfo-3.16.3-150000.1.38.1 * helm-3.16.3-150000.1.38.1 * Containers Module 15-SP6 (noarch) * helm-zsh-completion-3.16.3-150000.1.38.1 * helm-bash-completion-3.16.3-150000.1.38.1 * SUSE Package Hub 15 15-SP5 (noarch) * helm-fish-completion-3.16.3-150000.1.38.1 * SUSE Package Hub 15 15-SP6 (noarch) * helm-fish-completion-3.16.3-150000.1.38.1 ## References: * https://www.suse.com/security/cve/CVE-2024-25620.html * https://www.suse.com/security/cve/CVE-2024-26147.html * https://bugzilla.suse.com/show_bug.cgi?id=1219969 * https://bugzilla.suse.com/show_bug.cgi?id=1220207 * https://jira.suse.com/browse/MSC-899 * https://jira.suse.com/browse/SMO-479