CVE's in Helm 3.10.2 and 3.10.3

[SaradaSastri]

Output of helm version: helm.sh/helm/v3 v3.10.2

Output of kubectl version: n/a

Cloud Provider/Platform (AKS, GKE, Minikube etc.): n/a

We are using the latest version of Helm 3.10.2 to find the below CVE's. Please fix them in your next release.

github.com/docker/docker - v20.10.17+incompatible

Fixed version - 20.10.18

CVE-2022-30630--high
CVE-2022-30631--high
CVE-2022-30632--high
CVE-2022-30633--high
CVE-2022-30635--high
CVE-2022-27664--high
CVE-2022-32189--high
CVE-2022-32190--high
CVE-2022-28131--high
CVE-2022-36109--medium
CVE-2022-1705--medium
CVE-2022-1962--medium
CVE-2022-32148--medium

github.com/containerd/containerd -v1.6.6

Fixed version
1.5.14, 1.6.7, 1.7.0b0
1.5.14, 1.6.9, 1.7.0b0
1.5.15, 1.6.10
1.5.16, 1.6.12

CVE's
CVE-2022-30631--high
CVE-2022-2879--high
CVE-2022-28131--high
CVE-2022-30630--high
CVE-2019-2054--high
CVE-2022-2880--high
CVE-2022-41716--high
CVE-2022-30633--high
CVE-2022-30632--high
CVE-2022-32189--high
CVE-2022-30635--high
CVE-2022-41720--high
CVE-2022-41715--high
CVE-2022-1705--medium
CVE-2022-1962--medium
CVE-2022-23471--medium
CVE-2022-32148--medium
CVE-2022-41717--medium

[yxxhero]

@SaradaSastri PR is welcome. In addition. helm is just only a CLI tool.

[ju1ianvn]

Hello, I would like to add the following to the list: PRISMA-2022-0227. Is solved in the next version:
github.com/emicklei/go-restful/v3 v3.10.1 (The PR -- emicklei/go-restful#497)

[joejulian]

I'll say the same thing I said in the other CVE issue:

I'm on the other side of this problem at least once a quarter. Recalculating the CVSS is one correct way to address CVE scan results. I use https://www.first.org/cvss/calculator/3.0. Most audit tools allow for rescoring with justification. We usually do it that way because even when we do contribute fixes for CVEs upstream, it's often months before the upstream tool gets released and we can't wait that long.

All of these can be rescored because the code for which these CVEs are relevant is not executed by helm.

That said, if someone wants to open a PR to bump dependencies to versions that don't have any CVEs, I'm sure that would be appreciated by the maintainers as well as the rest of the community. :)

[matskiv]

FYI, reported Docker and containerd CVEs are fixed in Helm 3.11.0. Based on the release notes, the next patch release will be 3.11.1, so I don't know if 3.10.x patch release with a fix is to be expected.

[azuterios]

Hello, I would like to add the following to the list: PRISMA-2022-0227. Is solved in the next version: github.com/emicklei/go-restful/v3 v3.10.1 (The PR -- emicklei/go-restful#497)

Hello, PRISMA-2022-0227 is still present in HELM release 3.11.2. Could you be able to provide a roadmap or a resolution statement on when we can expect the go-restful version to be updated? Thank you!

[joejulian]

As far as I know, it'll be with dependabot opens the PR. 🤷

[SaradaSastri]

github.com/containerd/containerd v1.6.15

github.com/docker/docker v20.10.21+incompatible

Closing this issue, as the versions are upgraded as asked for in the ticket