CVE-2022-23524: Helm vulnerable to Denial of service through string value parsing
A flaw was found in Helm, a tool for managing Charts, a pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption. Input to functions in the strvals package could cause a stack overflow that is unrecoverable by Go. Applications that use functions from the strvals package in Helm SDK may result in a denial of service.
Other sources
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the strvals package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the strvals package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the strvals functions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-23524?
CVE-2022-23524 is a vulnerability in Helm, a tool for managing Charts, that allows for Uncontrolled Resource Consumption, resulting in Denial of Service.
What is the severity of CVE-2022-23524?
The severity of CVE-2022-23524 is high, with a severity value of 7.5.
Which versions of Helm are affected by CVE-2022-23524?
Versions prior to 3.10.3 of Helm are affected by CVE-2022-23524.
How do I fix CVE-2022-23524?
To fix CVE-2022-23524, update Helm to version 3.10.3 or later.
Where can I find more information about CVE-2022-23524?
You can find more information about CVE-2022-23524 on the CVE website, NIST NVD, and the Helm GitHub security advisories.