-
Notifications
You must be signed in to change notification settings - Fork 717
Upgrade helm in console #16607
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
sowmya-sl
wants to merge
5
commits into
openshift:main
Choose a base branch
from
sowmya-sl:upgrade-helm-in-console
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Upgrade helm in console #16607
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
b1137dc
HELM-731: Update pkg/helm imports from helm.sh/helm/v3 to v4
sowmya-sl e6a1d21
HELM-731: Adapt code to Helm v4 API changes
sowmya-sl 720a261
HELM-731: Fix Helm v4 runtime API usage in actions and handlers
sowmya-sl 369e05c
HELM-731: Migrate pkg/helm to Helm v4 API with safe type assertions
sowmya-sl c88249f
HELM-731: Set Helm v4 required defaults for ServerSideApply and WaitS…
sowmya-sl File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,9 +5,9 @@ import ( | |
| "os" | ||
|
|
||
| "github.com/openshift/api/helm/v1beta1" | ||
| "helm.sh/helm/v3/pkg/action" | ||
| "helm.sh/helm/v3/pkg/chart" | ||
| "helm.sh/helm/v3/pkg/chart/loader" | ||
| "helm.sh/helm/v4/pkg/action" | ||
| chart "helm.sh/helm/v4/pkg/chart/v2" | ||
| "helm.sh/helm/v4/pkg/chart/v2/loader" | ||
|
Comment on lines
+9
to
+10
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This raises a red flag: the reason for upgrading to the v4 SDK is to get support for chart-v3 features, so simply replacing |
||
|
|
||
| "k8s.io/client-go/dynamic" | ||
| corev1client "k8s.io/client-go/kubernetes/typed/core/v1" | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/console
Length of output: 151
🏁 Script executed:
Repository: openshift/console
Length of output: 50373
🏁 Script executed:
Repository: openshift/console
Length of output: 19408
🌐 Web query:
OSV vulnerabilities for helm.sh/helm/v3 v3.17.1 (highest severity)💡 Result:
As of June 12, 2026, version 3.17.1 of helm.sh/helm/v3 is affected by multiple vulnerabilities, including high-severity issues. The two most prominent vulnerabilities identified for this specific version are: 1. CVE-2025-32386 (GHSA-4hfp-h4cw-hj8p): A specially crafted chart archive can cause Out-Of-Memory (OOM) termination. A chart can be designed to expand to a significantly larger size when uncompressed, exhausting available memory during loading [1][2][3]. 2. CVE-2025-32387 (GHSA-5xqw-8hwv-wg92): A specially crafted JSON Schema within a chart can cause a stack overflow. Deeply nested chains of references in the schema can exceed the parser's stack size limit [4][5][6]. Both of these vulnerabilities have a severity rating of 6.5 (Medium, according to CVSS v3.1) and were resolved in Helm v3.17.3 [4][5][1][6][3]. Users running v3.17.1 are advised to upgrade to a patched version to mitigate these risks [6][3]. Additionally, version 3.17.1 is affected by CVE-2025-53547 (GHSA-557j-xg8c-q2mm), which involves potential local code execution when updating dependencies if a malicious Chart.lock symlink is present; this was resolved in Helm v3.17.4 and v3.18.4 [7].
Citations:
🌐 Web query:
osv.dev helm.sh/helm/v3 3.17.1 advisory💡 Result:
Helm version 3.17.1 is affected by several security vulnerabilities that have been addressed in subsequent releases. Users are advised to upgrade to a newer version to mitigate these risks. Key vulnerabilities affecting Helm 3.17.1 include: 1. Stack Overflow via JSON Schema (CVE-2025-32387): A vulnerability exists where a specially crafted JSON Schema within a chart can lead to parser recursion, exceeding stack size limits and causing a stack overflow [1][2][3]. This was resolved in Helm v3.17.3 [1][2][3]. 2. Out-of-Memory (OOM) Termination via Chart Archive (CVE-2025-32386): Helm is vulnerable to OOM termination if a specially crafted chart archive is loaded, where the uncompressed size is significantly larger than the compressed size [4][5][6]. This issue was resolved in Helm v3.17.3 [4][5][6]. 3. Local Code Execution during Dependency Updates (CVE-2025-53547): A vulnerability involving malicious Chart.yaml content and symbolic links in Chart.lock files can lead to local code execution during dependency updates [7][8]. This was resolved in Helm v3.17.4 and v3.18.4 [7][8]. Given these vulnerabilities, upgrading to the latest available version of Helm is recommended to ensure all security patches are applied [7][2][5][8]. You can verify vulnerability statuses and associated advisories through the official OSV.dev database or the Helm GitHub repository security advisories page [1][9][7][2][5][8].
Citations:
Remove or patch the leftover Helm v3 module
go.modstill pinshelm.sh/helm/v3 v3.17.1 // indirect, and this version is pulled into the vendored build viagithub.com/redhat-certification/chart-verifier(while the console’s own Helm handler code imports Helm v4). OSV reports multiple vulnerabilities forv3.17.1(notably CVE-2025-32386, CVE-2025-32387, CVE-2025-53547), with fixes inv3.17.3/v3.17.4/v3.18.4. Update the transitive Helm v3 dependency by bumping the chart-verifier dependency (or pinninghelm.sh/helm/v3to the patched version viareplace) so the module graph/vendor no longer usesv3.17.1.🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
(GO-2025-3601)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm
(GO-2025-3602)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm
(GO-2025-3802)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm
(GO-2025-3887)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm May Panic Due To Incorrect YAML Content in helm.sh/helm
(GO-2025-3888)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
(GHSA-4hfp-h4cw-hj8p)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm vulnerable to Code Injection through malicious chart.yaml content
(GHSA-557j-xg8c-q2mm)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
(GHSA-5xqw-8hwv-wg92)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
(GHSA-9h84-qmv7-982p)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm May Panic Due To Incorrect YAML Content
(GHSA-f9f8-9pmf-xv68)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Chart extraction output directory collapse via
Chart.yamlname dot-segment(GHSA-hr2v-4r36-88hr)
🤖 Prompt for AI Agents
Sources: Coding guidelines, Linters/SAST tools
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
redhat-certification/chart-verifier#620
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Length of output: 988
@sowmya-slThanks for filing redhat-certification/chart-verifier#623 to track the upstream upgrade. Since that issue is freshly opened and has no timeline yet, the transitivehelm.sh/helm/v3 v3.17.1will remain in the module graph for some time.As a short-term mitigation until chart-verifier upgrades, consider adding a
replacedirective ingo.modto pin the transitive v3 dependency to a patched release: