High severity · published Dec 15, 2022
CVE-2022-23525
Helm is a tool for managing Charts, pre-configured Kubernetes resources
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Helm · Helm
3.0.0 before 3.10.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23525
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23525
Patch
https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b
Third Party Advisory
https://github.com/helm/helm/security/advisories/GHSA-53c4-hhmh-vw5q
More from Helm
9.8
CVE-2019-18658
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive…
9.8
CVE-2019-1010275
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation
8.6
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
8.6
CVE-2025-53547
Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
8.6
CVE-2021-32690
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources)
