Detections
Analytics

SCA: security update for helm.sh/helm/v3 (GHSA-67fx-wx78-jx33)

high Tenable Cloud Security Plugin ID 411275

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are
 subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The
 _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm
 client when rendering a chart will validate its values with the schema file. The _chartutil_ package
 parses the schema file and loads it into structures Go can work with. Some schema files can cause array
 data structures to be created causing a memory violation. Applications that use the _chartutil_ package in
 the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that
 cannot be recovered from. Helm is not a long running service so the panic will not affect future uses of
 the Helm client. This issue has been patched in 3.10.3. SDK users can validate schema files that are
 correctly formatted before passing them to the _chartutil_ functions. (CVE-2022-23526)

See Also

https://github.com/advisories/GHSA-67fx-wx78-jx33

Plugin Details

Severity: High

ID: 411275

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-23526

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/14/2022

Vulnerability Publication Date: 12/13/2022

Reference Information

CVE: CVE-2022-23526

cwe: CWE-476