Detections
Analytics

SCA: security update for helm.sh/helm/v3 (GHSA-6rx9-889q-vv2r)

high Tenable Self-Hosted Container Security Plugin ID 411620

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are
 subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the
 _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from.
 Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service
 attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can
 validate strings supplied by users won't create large arrays causing significant memory usage before
 passing them to the _strvals_ functions. (CVE-2022-23524)

See Also

https://github.com/advisories/GHSA-6rx9-889q-vv2r

Plugin Details

Severity: High

ID: 411620

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-23524

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/14/2022

Vulnerability Publication Date: 12/13/2022

Reference Information

CVE: CVE-2022-23524

cwe: CWE-400