{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for helm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for helm fixes the following issues:\n\nUpdate to version 3.18.3:\n\n  * build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0\n    6838ebc (dependabot[bot])\n  * fix: user username password for login 5b9e2f6 (Terry Howe)\n  * Update pkg/registry/transport.go 2782412 (Terry Howe)\n  * Update pkg/registry/transport.go e66cf6a (Terry Howe)\n  * fix: add debug logging to oci transport 191f05c (Terry Howe)\n\nUpdate to version 3.18.2:\n\n  * fix: legacy docker support broken for login 04cad46 (Terry\n    Howe)\n  * Handle an empty registry config file. bc9f8a2 (Matt Farina)\n\nUpdate to version 3.18.1:\n\n  * Notes:\n\n    - This release fixes regressions around template generation and\n      OCI registry interaction in 3.18.0\n    - There are at least 2 known regressions unaddressed in this\n      release. They are being worked on.\n      - Empty registry configuration files. When the file exists\n        but it is empty.\n      - Login to Docker Hub on some domains fails.\n\n  * Changelog\n\n    - fix(client): skipnode utilization for PreCopy\n    - fix(client): layers now returns manifest - remove duplicate\n      from descriptors\n    - fix(client): return nil on non-allowed media types\n    - Prevent fetching newReference again as we have in calling\n      method\n    - Prevent failure when resolving version tags in oras memory\n      store\n    - Update pkg/plugin/plugin.go\n    - Update pkg/plugin/plugin.go\n    - Wait for Helm v4 before raising when platformCommand and\n      Command are set\n    - Fix 3.18.0 regression: registry login with scheme\n    - Revert \"fix (helm) : toToml` renders int as float [ backport\n      to v3 ]\"\n\nUpdate to version 3.18.0 (bsc#1241802, CVE-2025-22872):\n\n  * Notable Changes\n\n    - Add support for JSON Schema 2020\n    - Enabled cpu and memory profiling\n    - Add hook annotation to output hook logs to client on error\n\n  * Changelog\n\n    - build(deps): bump the k8s-io group with 7 updates\n    - fix: govulncheck workflow\n    - bump version to v3.18.0\n    - fix:add proxy support when mTLS configured\n    - docs: Note about http fallback for OCI registries\n    - Bump net package to avoid CVE on dev-v3\n    - Bump toml\n    - backport #30677to dev3\n    - build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to\n      1.8.0\n    - Add install test for TakeOwnership flag\n    - Fix --take-ownership\n    - build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to\n      1.7.2\n    - build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0\n    - build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0\n    - Testing text bump\n    - Permit more Go version and not only 1.23.8\n    - Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3\n      to 3.0.0\n    - Report as debug log, the time spent waiting for resources\n    - build(deps): bump github.com/containerd/containerd from\n      1.7.26 to 1.7.27\n    - Update pkg/registry/fallback.go\n    - automatic fallback to http\n    - chore(oci): upgrade to ORAS v2\n    - Updating to 0.37.0 for x/net\n    - build(deps): bump the k8s-io group with 7 updates\n    - build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0\n    - build(deps): bump github.com/opencontainers/image-spec\n    - build(deps): bump github.com/containerd/containerd from\n      1.7.25 to 1.7.26\n    - build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0\n    - Fix cherry-pick helm.sh/helm/v4 -\u003e helm.sh/helm/v3\n    - Add HookOutputFunc and generic yaml unmarshaller\n    - clarify fix error message\n    - remove comments about previous functionality\n    - add short circuit return\n    - Add hook annotations to output pod logs to client on success\n      and fail\n    - chore: use []error instead of []string\n    - Update cmd/helm/profiling.go\n    - chore: update profiling doc in CONTRIBUTING.md\n    - Prefer environment variables to CLI flags\n    - Fix linter warning\n    - Move pprof paths to HELM_PPROF env variable\n    - Additional review fixes from PR\n    - feat: Add flags to enable CPU and memory profiling\n    - build(deps): bump github.com/distribution/distribution/v3\n    - build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1\n    - Moving to SetOut and SetErr for Cobra\n    - build(deps): bump the k8s-io group with 7 updates\n    - build(deps): bump golang.org/x/crypto from 0.32.0 to 0.33.0\n    - build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0\n    - build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0\n    - build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6\n    - build(deps): bump github.com/cyphar/filepath-securejoin\n    - build(deps): bump github.com/evanphx/json-patch\n    - build(deps): bump the k8s-io group with 7 updates\n    - fix: check group for resource info match\n    - Bump github.com/cyphar/filepath-securejoin from 0.3.6 to\n      0.4.0\n    - add test for nullifying nested global value\n    - Ensuring the file paths are clean prior to passing to\n      securejoin\n    - Bump github.com/containerd/containerd from 1.7.24 to 1.7.25\n    - Bump golang.org/x/crypto from 0.31.0 to 0.32.0\n    - Bump golang.org/x/term from 0.27.0 to 0.28.0\n    - bump version to v3.17.0\n    - Bump github.com/moby/term from 0.5.0 to 0.5.2\n    - Add test case for removing an entire object\n    - Tests for bugfix: Override subcharts with null values #12879\n    - feat: Added multi-platform plugin hook support to v3\n    - This commit fixes the issue where the yaml.Unmarshaller\n      converts all int values into float64, this passes in option\n      to decoder, which enables conversion of int into .\n    - merge null child chart objects\n\nUpdate to version 3.17.3:\n\n  Helm v3.17.3 is a security (patch) release. Users are strongly\n  recommended to update to this release.\n\n  * Changelog\n    - Unarchiving fix e4da497 (Matt Farina)\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-162",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20457-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20457-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520457-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20457-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-July/040656.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241802",
        "url": "https://bugzilla.suse.com/1241802"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      }
    ],
    "title": "Security update for helm",
    "tracking": {
      "current_release_date": "2025-06-28T05:59:18Z",
      "generator": {
        "date": "2025-06-28T05:59:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20457-1",
      "initial_release_date": "2025-06-28T05:59:18Z",
      "revision_history": [
        {
          "date": "2025-06-28T05:59:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.18.3-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "helm-3.18.3-slfo.1.1_1.1.aarch64",
                  "product_id": "helm-3.18.3-slfo.1.1_1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch",
                "product": {
                  "name": "helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch",
                  "product_id": "helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.18.3-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "helm-3.18.3-slfo.1.1_1.1.s390x",
                  "product_id": "helm-3.18.3-slfo.1.1_1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.18.3-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "helm-3.18.3-slfo.1.1_1.1.x86_64",
                  "product_id": "helm-3.18.3-slfo.1.1_1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.18.3-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "helm-3.18.3-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.18.3-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.s390x"
        },
        "product_reference": "helm-3.18.3-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.18.3-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "helm-3.18.3-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch"
        },
        "product_reference": "helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.18.3-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.18.3-slfo.1.1_1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-28T05:59:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    }
  ]
}