{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "135AAD77-267A-4119-877F-60195A002775",
                     versionEndExcluding: "3.10.3",
                     versionStartIncluding: "3.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.",
      },
      {
         lang: "es",
         value: "Helm es una herramienta para gestionar gráficos, recursos de Kubernetes preconfigurados. Las versiones anteriores a la 3.10.3 están sujetas a la desreferencia de puntero NULL en el _repo_package. El _repo_package contiene un controlador que procesa el archivo de índice de un repositorio. Por ejemplo, el cliente Helm agrega referencias a repositorios de gráficos donde se administran los gráficos. El _repo_package analiza el archivo de índice del repositorio y lo carga en estructuras con las que Go puede trabajar. Algunos archivos de índice pueden provocar la creación de estructuras de datos de matriz, lo que provoca una violación de la memoria. Las aplicaciones que utilizan el _repo_package en el SDK de Helm para analizar un archivo de índice pueden sufrir una Denegación de Servicio (DoS) cuando esa entrada provoca un pánico del que no se puede recuperar. El cliente Helm entrará en pánico con un archivo de índice que provocará una violación de memoria. Helm no es un servicio de larga duración, por lo que el pánico no afectará los usos futuros del cliente Helm. Este problema se solucionó en 3.10.3. Los usuarios del SDK pueden validar los archivos de índice que estén formateados correctamente antes de pasarlos a las funciones _repo_.",
      },
   ],
   id: "CVE-2022-23525",
   lastModified: "2024-11-21T06:48:44.937",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-12-15T19:15:17.027",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/helm/helm/security/advisories/GHSA-53c4-hhmh-vw5q",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/helm/helm/security/advisories/GHSA-53c4-hhmh-vw5q",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-476",
            },
         ],
         source: "security-advisories@github.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-476",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}