fix(deps): update module helm.sh/helm/v4 to v4.1.4 [security]#557
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
fix(deps): update module helm.sh/helm/v4 to v4.1.4 [security]#557renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
Contributor
Author
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #557 +/- ##
=======================================
Coverage 68.74% 68.74%
=======================================
Files 53 53
Lines 3513 3513
=======================================
Hits 2415 2415
Misses 863 863
Partials 235 235 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.1.3→v4.1.4GitHub Vulnerability Alerts
CVE-2026-35206
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause
helm pull --untar [chart URL | repo/chartname]to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the--destinationand--untardirflags), rather than the expected output directory suffixed by the chart's name.Impact
The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory
<output dir>/, instead of the expected<output dir>/<chart name>/, potentially overwriting the contents of the targeted directory.Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed.
Patches
This issue has been resolved in Helm v3.20.2 and v4.1.3
A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected.
Workarounds
Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the
pull --untarflag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory.Credits
Oleh Konko
@1seal
CVE-2026-35204
Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location.
Impact
A Helm user who installs or updates a plugin that is specially crafted can cause Helm to attempt to write the content of the affected plugin to an arbitrary location on the user's filesystem. Impacted users risk potentially overwriting user and system files which may further compromise the integrity of a system.
Patches
This issue has been patched in Helm v4.1.4
Installing/updating a plugin with a non-SemVer version (which excludes path traversal patterns) will result in an error.
Workarounds
Validate that the
plugin.yamlof the Helm plugin does not include aversion:field containing POSIX dot-dot path separators ie. "/../".CVE-2026-35205
Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (
.provfile) when signature verification is required.Impact
The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update.
Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code.
Patches
This issue has been patched in Helm v4.1.4
Installing/updating a plugin with missing provenance will error if signature verification is required.
Workarounds
Users may manually validate that a plugin archive is not missing provenance data (
.provfile) before installation.Release Notes
helm/helm (helm.sh/helm/v4)
v4.1.4: Helm v4.1.4Compare Source
Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Security fixes
Chart.yamlname dot-segment.provis missing, allowing unsigned plugin installA big thank you to the reporters of these issues (@maru1009, @1seal).
Installation and Upgrading
Download Helm v4.1.4. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
05fa379(George Jenkins)4e7994d(George Jenkins)2581943(George Jenkins)36c8539(George Jenkins)c61e086(Terry Howe)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.