{
  "affected": [
    {
      "affectedData": [
        {
          "product": "oras",
          "vendor": "deislabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.0, \u003c 0.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "93510360-3674-4A55-9BB0-5FA39B53B970",
              "versionEndExcluding": "0.9.0",
              "versionStartIncluding": "0.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
    },
    {
      "lang": "es",
      "value": "ORAS es un software de c\u00f3digo abierto que permite una forma de empujar artefactos OCI a registros conformes con OCI. ORAS es tanto un CLI para pruebas iniciales como un m\u00f3dulo Go. En ORAS a partir de la versi\u00f3n 0.4.0 y anterior a la versi\u00f3n 0.9.0, existe una vulnerabilidad de \"deslizamiento de zip\". La funci\u00f3n de soporte de directorios permite que los tarballs gzipped descargados se extraigan autom\u00e1ticamente al directorio especificado por el usuario, donde el tarball puede tener enlaces simb\u00f3licos y enlaces duros. Un tarball o tarballs bien elaborados permiten a los proveedores de artefactos maliciosos enlazar, escribir o sobrescribir archivos espec\u00edficos en el sistema de archivos del host fuera del directorio especificado por el usuario de forma inesperada con los mismos permisos que el usuario que ejecuta `oras pull`. Los usuarios de las versiones afectadas se ven afectados si son usuarios de `oras` CLI que ejecutan `oras pull`, o si son programas Go, que invocan `github.com/deislabs/oras/pkg/content.FileStore`. El problema ha sido corregido en la versi\u00f3n 0.9.0. Para los usuarios de la CLI de `oras`, no hay ninguna soluci\u00f3n que no sea la de extraer de un proveedor de artefactos de confianza. Para los usuarios del paquete `oras`, la soluci\u00f3n es no utilizar `github.com/deislabs/oras/pkg/content.FileStore`, y utilizar otros almacenes de contenido en su lugar, o tirar de un proveedor de artefactos de confianza"
    }
  ],
  "id": "CVE-2021-21272",
  "lastModified": "2026-06-17T03:35:10.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-01-25T19:15:12.847",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/deislabs/oras"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T14:42:50Z",
    "nvd_published_at": "2021-01-25T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe directory support (#55) allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links.\n\nA well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. \n\nPrecisely, the following users of the affected versions are impacted\n- `oras` CLI users who runs `oras pull`.\n- Go programs, which invokes `github.com/deislabs/oras/pkg/content.FileStore`.\n\n### Patches\nThe problem has been patched by the PR linked with this advisory. Users should upgrade their `oras` CLI and packages to `0.9.0`.\n\n### Workarounds\nFor `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider.\n\nFor `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.\n\n### References\n- [Zip Slip](https://github.com/snyk/zip-slip-vulnerability)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue on the [GitHub repo](https://github.com/deislabs/oras)\n* Email the [list of maintainers](https://github.com/deislabs/oras/blob/main/MAINTAINERS)",
  "id": "GHSA-g5v4-5x39-vwhx",
  "modified": "2022-10-25T20:26:42Z",
  "published": "2022-02-15T00:32:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/deislabs/oras"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2021-0099"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zip slip directory exploit in github.com/deislabs/oras"
}

{
  "GSD": {
    "alias": "CVE-2021-21272",
    "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
    "id": "GSD-2021-21272",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-21272.html",
      "https://access.redhat.com/errata/RHSA-2021:3016"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-21272"
      ],
      "details": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
      "id": "GSD-2021-21272",
      "modified": "2023-12-13T01:23:11.274609Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-21272",
        "STATE": "PUBLIC",
        "TITLE": "zip slip in ORAS"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "oras",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 0.4.0, \u003c 0.9.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "deislabs"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
            "refsource": "CONFIRM",
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "name": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
            "refsource": "MISC",
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "name": "https://github.com/deislabs/oras/releases/tag/v0.9.0",
            "refsource": "MISC",
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "name": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
            "refsource": "MISC",
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-g5v4-5x39-vwhx",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv0.9.0",
          "affected_versions": "All versions before 0.9.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2022-02-15",
          "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS suffers from a `zip-slip` vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`.",
          "fixed_versions": [
            "v0.9.0"
          ],
          "identifier": "CVE-2021-21272",
          "identifiers": [
            "GHSA-g5v4-5x39-vwhx",
            "CVE-2021-21272"
          ],
          "not_impacted": "All versions starting from 0.9.0",
          "package_slug": "go/github.com/deislabs/oras",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.9.0 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21272",
            "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
            "https://github.com/deislabs/oras/releases/tag/v0.9.0",
            "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
            "https://github.com/advisories/GHSA-g5v4-5x39-vwhx"
          ],
          "uuid": "372f90ae-00e7-4cb8-ba24-ec8285b238de",
          "versions": [
            {
              "commit": {
                "sha": "96cd90423303f1bb42bd043cb4c36085e6e91e8e",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20210122152641"
              },
              "number": "v0.9.0"
            }
          ]
        },
        {
          "affected_range": "\u003cv0.9.0",
          "affected_versions": "All versions before 0.9.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-59",
            "CWE-937"
          ],
          "date": "2023-02-07",
          "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
          "fixed_versions": [
            "v0.9.0"
          ],
          "identifier": "CVE-2021-21272",
          "identifiers": [
            "GHSA-g5v4-5x39-vwhx",
            "CVE-2021-21272"
          ],
          "not_impacted": "All versions starting from 0.9.0",
          "package_slug": "go/github.com/deislabs/oras/pkg/content",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.9.0 or above.",
          "title": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
          "urls": [
            "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21272",
            "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
            "https://github.com/deislabs/oras/releases/tag/v0.9.0",
            "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
            "https://pkg.go.dev/vuln/GO-2021-0099",
            "https://github.com/advisories/GHSA-g5v4-5x39-vwhx"
          ],
          "uuid": "d6d369f8-df8d-41a0-ad17-41d073bfe2e9",
          "versions": [
            {
              "commit": {
                "sha": "96cd90423303f1bb42bd043cb4c36085e6e91e8e",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20210122152641"
              },
              "number": "v0.9.0"
            }
          ]
        },
        {
          "affected_range": "\u003e=v0.4.0 \u003cv0.9.0",
          "affected_versions": "All versions starting from 0.4.0 before 0.9.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-59",
            "CWE-937"
          ],
          "date": "2022-10-25",
          "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries.For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
          "fixed_versions": [
            "v0.9.0"
          ],
          "identifier": "CVE-2021-21272",
          "identifiers": [
            "CVE-2021-21272",
            "GHSA-g5v4-5x39-vwhx"
          ],
          "not_impacted": "All versions before 0.4.0, all versions starting from 0.9.0",
          "package_slug": "go/github.com/deislabs/oras/pkg/oras",
          "pubdate": "2021-01-25",
          "solution": "Upgrade to version 0.9.0 or above.",
          "title": "Path Traversal",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21272"
          ],
          "uuid": "9078f635-6641-4f98-b288-0bc1acd26670",
          "versions": [
            {
              "commit": {
                "sha": "daecb6fb4acd5194059994e6f4bd367ad00b3b76",
                "tags": [
                  "v0.4.0"
                ],
                "timestamp": "20190419173700"
              },
              "number": "v0.4.0"
            },
            {
              "commit": {
                "sha": "96cd90423303f1bb42bd043cb4c36085e6e91e8e",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20210122152641"
              },
              "number": "v0.9.0"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "93510360-3674-4A55-9BB0-5FA39B53B970",
                    "versionEndExcluding": "0.9.0",
                    "versionStartIncluding": "0.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
          },
          {
            "lang": "es",
            "value": "ORAS es un software de c\u00f3digo abierto que permite una forma de empujar artefactos OCI a registros conformes con OCI. ORAS es tanto un CLI para pruebas iniciales como un m\u00f3dulo Go. En ORAS a partir de la versi\u00f3n 0.4.0 y anterior a la versi\u00f3n 0.9.0, existe una vulnerabilidad de \"deslizamiento de zip\". La funci\u00f3n de soporte de directorios permite que los tarballs gzipped descargados se extraigan autom\u00e1ticamente al directorio especificado por el usuario, donde el tarball puede tener enlaces simb\u00f3licos y enlaces duros. Un tarball o tarballs bien elaborados permiten a los proveedores de artefactos maliciosos enlazar, escribir o sobrescribir archivos espec\u00edficos en el sistema de archivos del host fuera del directorio especificado por el usuario de forma inesperada con los mismos permisos que el usuario que ejecuta `oras pull`. Los usuarios de las versiones afectadas se ven afectados si son usuarios de `oras` CLI que ejecutan `oras pull`, o si son programas Go, que invocan `github.com/deislabs/oras/pkg/content.FileStore`. El problema ha sido corregido en la versi\u00f3n 0.9.0. Para los usuarios de la CLI de `oras`, no hay ninguna soluci\u00f3n que no sea la de extraer de un proveedor de artefactos de confianza. Para los usuarios del paquete `oras`, la soluci\u00f3n es no utilizar `github.com/deislabs/oras/pkg/content.FileStore`, y utilizar otros almacenes de contenido en su lugar, o tirar de un proveedor de artefactos de confianza"
          }
        ],
        "id": "CVE-2021-21272",
        "lastModified": "2024-02-21T20:39:19.723",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-01-25T19:15:12.847",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-59"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "helm-3.9.4-3.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the helm-3.9.4-3.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-12345",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12345-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-21272 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-21272/"
      }
    ],
    "title": "helm-3.9.4-3.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:12345-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.9.4-3.1.aarch64",
                "product": {
                  "name": "helm-3.9.4-3.1.aarch64",
                  "product_id": "helm-3.9.4-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.9.4-3.1.aarch64",
                "product": {
                  "name": "helm-bash-completion-3.9.4-3.1.aarch64",
                  "product_id": "helm-bash-completion-3.9.4-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-3.9.4-3.1.aarch64",
                "product": {
                  "name": "helm-fish-completion-3.9.4-3.1.aarch64",
                  "product_id": "helm-fish-completion-3.9.4-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-3.9.4-3.1.aarch64",
                "product": {
                  "name": "helm-zsh-completion-3.9.4-3.1.aarch64",
                  "product_id": "helm-zsh-completion-3.9.4-3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.9.4-3.1.ppc64le",
                "product": {
                  "name": "helm-3.9.4-3.1.ppc64le",
                  "product_id": "helm-3.9.4-3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.9.4-3.1.ppc64le",
                "product": {
                  "name": "helm-bash-completion-3.9.4-3.1.ppc64le",
                  "product_id": "helm-bash-completion-3.9.4-3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-3.9.4-3.1.ppc64le",
                "product": {
                  "name": "helm-fish-completion-3.9.4-3.1.ppc64le",
                  "product_id": "helm-fish-completion-3.9.4-3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-3.9.4-3.1.ppc64le",
                "product": {
                  "name": "helm-zsh-completion-3.9.4-3.1.ppc64le",
                  "product_id": "helm-zsh-completion-3.9.4-3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.9.4-3.1.s390x",
                "product": {
                  "name": "helm-3.9.4-3.1.s390x",
                  "product_id": "helm-3.9.4-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.9.4-3.1.s390x",
                "product": {
                  "name": "helm-bash-completion-3.9.4-3.1.s390x",
                  "product_id": "helm-bash-completion-3.9.4-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-3.9.4-3.1.s390x",
                "product": {
                  "name": "helm-fish-completion-3.9.4-3.1.s390x",
                  "product_id": "helm-fish-completion-3.9.4-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-3.9.4-3.1.s390x",
                "product": {
                  "name": "helm-zsh-completion-3.9.4-3.1.s390x",
                  "product_id": "helm-zsh-completion-3.9.4-3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.9.4-3.1.x86_64",
                "product": {
                  "name": "helm-3.9.4-3.1.x86_64",
                  "product_id": "helm-3.9.4-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.9.4-3.1.x86_64",
                "product": {
                  "name": "helm-bash-completion-3.9.4-3.1.x86_64",
                  "product_id": "helm-bash-completion-3.9.4-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-3.9.4-3.1.x86_64",
                "product": {
                  "name": "helm-fish-completion-3.9.4-3.1.x86_64",
                  "product_id": "helm-fish-completion-3.9.4-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-3.9.4-3.1.x86_64",
                "product": {
                  "name": "helm-zsh-completion-3.9.4-3.1.x86_64",
                  "product_id": "helm-zsh-completion-3.9.4-3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.9.4-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-3.9.4-3.1.aarch64"
        },
        "product_reference": "helm-3.9.4-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.9.4-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-3.9.4-3.1.ppc64le"
        },
        "product_reference": "helm-3.9.4-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.9.4-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-3.9.4-3.1.s390x"
        },
        "product_reference": "helm-3.9.4-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.9.4-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-3.9.4-3.1.x86_64"
        },
        "product_reference": "helm-3.9.4-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.9.4-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.aarch64"
        },
        "product_reference": "helm-bash-completion-3.9.4-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.9.4-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.ppc64le"
        },
        "product_reference": "helm-bash-completion-3.9.4-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.9.4-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.s390x"
        },
        "product_reference": "helm-bash-completion-3.9.4-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.9.4-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.x86_64"
        },
        "product_reference": "helm-bash-completion-3.9.4-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-3.9.4-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.aarch64"
        },
        "product_reference": "helm-fish-completion-3.9.4-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-3.9.4-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.ppc64le"
        },
        "product_reference": "helm-fish-completion-3.9.4-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-3.9.4-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.s390x"
        },
        "product_reference": "helm-fish-completion-3.9.4-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-3.9.4-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.x86_64"
        },
        "product_reference": "helm-fish-completion-3.9.4-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-3.9.4-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.aarch64"
        },
        "product_reference": "helm-zsh-completion-3.9.4-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-3.9.4-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.ppc64le"
        },
        "product_reference": "helm-zsh-completion-3.9.4-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-3.9.4-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.s390x"
        },
        "product_reference": "helm-zsh-completion-3.9.4-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-3.9.4-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.x86_64"
        },
        "product_reference": "helm-zsh-completion-3.9.4-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-21272",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-21272"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm-3.9.4-3.1.aarch64",
          "openSUSE Tumbleweed:helm-3.9.4-3.1.ppc64le",
          "openSUSE Tumbleweed:helm-3.9.4-3.1.s390x",
          "openSUSE Tumbleweed:helm-3.9.4-3.1.x86_64",
          "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.aarch64",
          "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.ppc64le",
          "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.s390x",
          "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.x86_64",
          "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.aarch64",
          "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.ppc64le",
          "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.s390x",
          "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.x86_64",
          "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.aarch64",
          "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.ppc64le",
          "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.s390x",
          "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-21272",
          "url": "https://www.suse.com/security/cve/CVE-2021-21272"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181419 for CVE-2021-21272",
          "url": "https://bugzilla.suse.com/1181419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-3.9.4-3.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-3.9.4-3.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-3.9.4-3.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-3.9.4-3.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-3.9.4-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-21272"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "helm3-3.19.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15779",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15779-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16873 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16873/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16874 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16874/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16875 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16875/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-21272 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-21272/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-1996 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-1996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23524 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23525 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23525/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23526 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23526/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-36055 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-36055/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-25165 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-25165/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-25173 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-25173/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-25620 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-25620/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-26147 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-26147/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45337 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45337/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45338 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22870 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53547 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53547/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      }
    ],
    "title": "helm3-3.19.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-11-28T00:00:00Z",
      "generator": {
        "date": "2025-11-28T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15779-1",
      "initial_release_date": "2025-11-28T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-11-28T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm3-3.19.2-1.1.aarch64",
                "product": {
                  "name": "helm3-3.19.2-1.1.aarch64",
                  "product_id": "helm3-3.19.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-bash-completion-3.19.2-1.1.aarch64",
                "product": {
                  "name": "helm3-bash-completion-3.19.2-1.1.aarch64",
                  "product_id": "helm3-bash-completion-3.19.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-fish-completion-3.19.2-1.1.aarch64",
                "product": {
                  "name": "helm3-fish-completion-3.19.2-1.1.aarch64",
                  "product_id": "helm3-fish-completion-3.19.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-zsh-completion-3.19.2-1.1.aarch64",
                "product": {
                  "name": "helm3-zsh-completion-3.19.2-1.1.aarch64",
                  "product_id": "helm3-zsh-completion-3.19.2-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm3-3.19.2-1.1.ppc64le",
                "product": {
                  "name": "helm3-3.19.2-1.1.ppc64le",
                  "product_id": "helm3-3.19.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-bash-completion-3.19.2-1.1.ppc64le",
                "product": {
                  "name": "helm3-bash-completion-3.19.2-1.1.ppc64le",
                  "product_id": "helm3-bash-completion-3.19.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-fish-completion-3.19.2-1.1.ppc64le",
                "product": {
                  "name": "helm3-fish-completion-3.19.2-1.1.ppc64le",
                  "product_id": "helm3-fish-completion-3.19.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-zsh-completion-3.19.2-1.1.ppc64le",
                "product": {
                  "name": "helm3-zsh-completion-3.19.2-1.1.ppc64le",
                  "product_id": "helm3-zsh-completion-3.19.2-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm3-3.19.2-1.1.s390x",
                "product": {
                  "name": "helm3-3.19.2-1.1.s390x",
                  "product_id": "helm3-3.19.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-bash-completion-3.19.2-1.1.s390x",
                "product": {
                  "name": "helm3-bash-completion-3.19.2-1.1.s390x",
                  "product_id": "helm3-bash-completion-3.19.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-fish-completion-3.19.2-1.1.s390x",
                "product": {
                  "name": "helm3-fish-completion-3.19.2-1.1.s390x",
                  "product_id": "helm3-fish-completion-3.19.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-zsh-completion-3.19.2-1.1.s390x",
                "product": {
                  "name": "helm3-zsh-completion-3.19.2-1.1.s390x",
                  "product_id": "helm3-zsh-completion-3.19.2-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm3-3.19.2-1.1.x86_64",
                "product": {
                  "name": "helm3-3.19.2-1.1.x86_64",
                  "product_id": "helm3-3.19.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-bash-completion-3.19.2-1.1.x86_64",
                "product": {
                  "name": "helm3-bash-completion-3.19.2-1.1.x86_64",
                  "product_id": "helm3-bash-completion-3.19.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-fish-completion-3.19.2-1.1.x86_64",
                "product": {
                  "name": "helm3-fish-completion-3.19.2-1.1.x86_64",
                  "product_id": "helm3-fish-completion-3.19.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm3-zsh-completion-3.19.2-1.1.x86_64",
                "product": {
                  "name": "helm3-zsh-completion-3.19.2-1.1.x86_64",
                  "product_id": "helm3-zsh-completion-3.19.2-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-3.19.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64"
        },
        "product_reference": "helm3-3.19.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-3.19.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le"
        },
        "product_reference": "helm3-3.19.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-3.19.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x"
        },
        "product_reference": "helm3-3.19.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-3.19.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64"
        },
        "product_reference": "helm3-3.19.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-bash-completion-3.19.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64"
        },
        "product_reference": "helm3-bash-completion-3.19.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-bash-completion-3.19.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le"
        },
        "product_reference": "helm3-bash-completion-3.19.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-bash-completion-3.19.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x"
        },
        "product_reference": "helm3-bash-completion-3.19.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-bash-completion-3.19.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64"
        },
        "product_reference": "helm3-bash-completion-3.19.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-fish-completion-3.19.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64"
        },
        "product_reference": "helm3-fish-completion-3.19.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-fish-completion-3.19.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le"
        },
        "product_reference": "helm3-fish-completion-3.19.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-fish-completion-3.19.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x"
        },
        "product_reference": "helm3-fish-completion-3.19.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-fish-completion-3.19.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64"
        },
        "product_reference": "helm3-fish-completion-3.19.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-zsh-completion-3.19.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64"
        },
        "product_reference": "helm3-zsh-completion-3.19.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-zsh-completion-3.19.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le"
        },
        "product_reference": "helm3-zsh-completion-3.19.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-zsh-completion-3.19.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x"
        },
        "product_reference": "helm3-zsh-completion-3.19.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm3-zsh-completion-3.19.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        },
        "product_reference": "helm3-zsh-completion-3.19.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-16873",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16873"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it\u0027s possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16873",
          "url": "https://www.suse.com/security/cve/CVE-2018-16873"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118897 for CVE-2018-16873",
          "url": "https://bugzilla.suse.com/1118897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118898 for CVE-2018-16873",
          "url": "https://bugzilla.suse.com/1118898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118899 for CVE-2018-16873",
          "url": "https://bugzilla.suse.com/1118899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-16873"
    },
    {
      "cve": "CVE-2018-16874",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16874"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both \u0027{\u0027 and \u0027}\u0027 characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16874",
          "url": "https://www.suse.com/security/cve/CVE-2018-16874"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118897 for CVE-2018-16874",
          "url": "https://bugzilla.suse.com/1118897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118898 for CVE-2018-16874",
          "url": "https://bugzilla.suse.com/1118898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118899 for CVE-2018-16874",
          "url": "https://bugzilla.suse.com/1118899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16874"
    },
    {
      "cve": "CVE-2018-16875",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16875"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16875",
          "url": "https://www.suse.com/security/cve/CVE-2018-16875"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118897 for CVE-2018-16875",
          "url": "https://bugzilla.suse.com/1118897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118898 for CVE-2018-16875",
          "url": "https://bugzilla.suse.com/1118898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118899 for CVE-2018-16875",
          "url": "https://bugzilla.suse.com/1118899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16875"
    },
    {
      "cve": "CVE-2021-21272",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-21272"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-21272",
          "url": "https://www.suse.com/security/cve/CVE-2021-21272"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181419 for CVE-2021-21272",
          "url": "https://bugzilla.suse.com/1181419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-21272"
    },
    {
      "cve": "CVE-2022-1996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-1996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-1996",
          "url": "https://www.suse.com/security/cve/CVE-2022-1996"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200528 for CVE-2022-1996",
          "url": "https://bugzilla.suse.com/1200528"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2022-1996"
    },
    {
      "cve": "CVE-2022-23524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won\u0027t create large arrays causing significant memory usage before passing them to the _strvals_ functions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23524",
          "url": "https://www.suse.com/security/cve/CVE-2022-23524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206467 for CVE-2022-23524",
          "url": "https://bugzilla.suse.com/1206467"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-23524"
    },
    {
      "cve": "CVE-2022-23525",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23525"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23525",
          "url": "https://www.suse.com/security/cve/CVE-2022-23525"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206469 for CVE-2022-23525",
          "url": "https://bugzilla.suse.com/1206469"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2022-23525"
    },
    {
      "cve": "CVE-2022-23526",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23526"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The _chartutil_ package parses the schema file and loads it into structures Go can work with. Some schema files can cause array data structures to be created causing a memory violation. Applications that use the _chartutil_ package in the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate schema files that are correctly formatted before passing them to the _chartutil_ functions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23526",
          "url": "https://www.suse.com/security/cve/CVE-2022-23526"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206471 for CVE-2022-23526",
          "url": "https://bugzilla.suse.com/1206471"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2022-23526"
    },
    {
      "cve": "CVE-2022-36055",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-36055"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. The _strvals_ package contains a parser that turns strings in to Go structures. The _strvals_ package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing an out of memory panic. Applications that use the _strvals_ package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been resolved in 3.9.4. SDK users can validate strings supplied by users won\u0027t create large arrays causing significant memory usage before passing them to the _strvals_ functions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-36055",
          "url": "https://www.suse.com/security/cve/CVE-2022-36055"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203054 for CVE-2022-36055",
          "url": "https://bugzilla.suse.com/1203054"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-36055"
    },
    {
      "cve": "CVE-2023-25165",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-25165"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-25165",
          "url": "https://www.suse.com/security/cve/CVE-2023-25165"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208083 for CVE-2023-25165",
          "url": "https://bugzilla.suse.com/1208083"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-25165"
    },
    {
      "cve": "CVE-2023-25173",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-25173"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd\u0027s client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-25173",
          "url": "https://www.suse.com/security/cve/CVE-2023-25173"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208426 for CVE-2023-25173",
          "url": "https://bugzilla.suse.com/1208426"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215588 for CVE-2023-25173",
          "url": "https://bugzilla.suse.com/1215588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-25173"
    },
    {
      "cve": "CVE-2024-25620",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-25620"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the `Chart.yaml` file. This includes dependencies.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-25620",
          "url": "https://www.suse.com/security/cve/CVE-2024-25620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219969 for CVE-2024-25620",
          "url": "https://bugzilla.suse.com/1219969"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-25620"
    },
    {
      "cve": "CVE-2024-26147",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-26147"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use `recover` to catch the panic.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-26147",
          "url": "https://www.suse.com/security/cve/CVE-2024-26147"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1220207 for CVE-2024-26147",
          "url": "https://bugzilla.suse.com/1220207"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-26147"
    },
    {
      "cve": "CVE-2024-45337",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45337"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45337",
          "url": "https://www.suse.com/security/cve/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234482 for CVE-2024-45337",
          "url": "https://bugzilla.suse.com/1234482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45337"
    },
    {
      "cve": "CVE-2024-45338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45338",
          "url": "https://www.suse.com/security/cve/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234794 for CVE-2024-45338",
          "url": "https://bugzilla.suse.com/1234794"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45338"
    },
    {
      "cve": "CVE-2025-22870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22870",
          "url": "https://www.suse.com/security/cve/CVE-2025-22870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238572 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238611 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22870"
    },
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-53547",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53547"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53547",
          "url": "https://www.suse.com/security/cve/CVE-2025-53547"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246150 for CVE-2025-53547",
          "url": "https://bugzilla.suse.com/1246150"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53547"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
          "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-bash-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-fish-completion-3.19.2-1.1.x86_64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.s390x",
            "openSUSE Tumbleweed:helm3-zsh-completion-3.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    }
  ]
}