VDB
RHSA-2024%3A1255
RHSA-2024%3A1255
PUBLISHED
CVSS 6.400000095367432 MEDIUM
A path traversal vulnerability was found in Helm when it saved a chart including download time. When either the Helm client or SDK is used to save a chart whose name is within the Chart.yaml file and includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.
Risk Scores
CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:c7805561da209665f1dbc9b97d96f710871b067ed349696d90f79d01665e6246_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:c7805561da209665f1dbc9b97d96f710871b067ed349696d90f79d01665e6246_s390x |
| Red Hat | openshift4/ose-tests@sha256:727a08dcaa3bd082b93a5d841a4388d4e60725aeec95962717f7cd5a54b90279_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-tests@sha256:727a08dcaa3bd082b93a5d841a4388d4e60725aeec95962717f7cd5a54b90279_s390x |
| Red Hat | openshift4/ose-sdn-rhel9@sha256:986b1a18efc4f960b23c38b8a6adb588dc1d52cc31be749513cc7d799949481e_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-sdn-rhel9@sha256:986b1a18efc4f960b23c38b8a6adb588dc1d52cc31be749513cc7d799949481e_s390x |
| Red Hat | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:88bcc7f5cc252d66079ee7c4ba610910e8ad96c24f22f704977bb835933f3019_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:88bcc7f5cc252d66079ee7c4ba610910e8ad96c24f22f704977bb835933f3019_ppc64le |
| Red Hat | openshift4/ose-hyperkube-rhel9@sha256:ce94941d4a1eec73f690087fbabce95ea1a9a51f737e40719dd0e56321f955ad_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-hyperkube-rhel9@sha256:ce94941d4a1eec73f690087fbabce95ea1a9a51f737e40719dd0e56321f955ad_s390x |
| Red Hat | rhcos@sha256:61752974681ea423d76d1c0c55c3626a6d7a90bccea1958071674057c01a8c38_x86_64 as a component of Red Hat OpenShift Container Platform 4.15 | rhcos@sha256:61752974681ea423d76d1c0c55c3626a6d7a90bccea1958071674057c01a8c38_x86_64 |
| Red Hat | openshift4/ose-hyperkube-rhel9@sha256:73e86d314d4ec1e5ad0a913dd44a627c15fdc0c62c36a792851bee55c09d8771_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-hyperkube-rhel9@sha256:73e86d314d4ec1e5ad0a913dd44a627c15fdc0c62c36a792851bee55c09d8771_amd64 |
| Red Hat | openshift4/ose-hypershift-rhel9@sha256:ede27fe3d22d34edf0900d7eac05082aac0427c85022be6221f816f5c9be4292_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-hypershift-rhel9@sha256:ede27fe3d22d34edf0900d7eac05082aac0427c85022be6221f816f5c9be4292_arm64 |
| Red Hat | openshift4/ose-console@sha256:e2c3a4477638754a138f8554a45e7b4158978363350bbfe5c6d96cd813ff8d73_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-console@sha256:e2c3a4477638754a138f8554a45e7b4158978363350bbfe5c6d96cd813ff8d73_ppc64le |
| Red Hat | openshift4/ose-pod-rhel9@sha256:d152617edada2d9b9ee5e5f38ac32b44c25fd49932678d6d4c3c18d63242485f_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-pod-rhel9@sha256:d152617edada2d9b9ee5e5f38ac32b44c25fd49932678d6d4c3c18d63242485f_arm64 |
| Red Hat | openshift4/ose-cluster-olm-operator-rhel8@sha256:8d8f74b111ba028ed2a6689dd88ac0a5b17deb04e5a967a95a13a50c5370a7aa_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cluster-olm-operator-rhel8@sha256:8d8f74b111ba028ed2a6689dd88ac0a5b17deb04e5a967a95a13a50c5370a7aa_ppc64le |
| Red Hat | openshift4/ose-cloud-credential-operator@sha256:a0426d394fc3c761095ba0a5a950a848a6e28b29a30a028671451d919f6f28f5_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cloud-credential-operator@sha256:a0426d394fc3c761095ba0a5a950a848a6e28b29a30a028671451d919f6f28f5_arm64 |
| Red Hat | openshift4/ose-tests@sha256:9ceb22a5aa3ad1da243a42e28ffb91c7e08cfd0b05e7df7d295abb33f956c952_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-tests@sha256:9ceb22a5aa3ad1da243a42e28ffb91c7e08cfd0b05e7df7d295abb33f956c952_ppc64le |
| Red Hat | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:7e827cd3b4c471c8358ba48889091d27570ff677a4694bb97c4b729958b7aa69_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:7e827cd3b4c471c8358ba48889091d27570ff677a4694bb97c4b729958b7aa69_arm64 |
| Red Hat | openshift4/ose-machine-config-operator@sha256:2cc3174c2541912cfcadcd8ade47363aa75d4fb80f1a0b712d88ad9fd11eea97_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-machine-config-operator@sha256:2cc3174c2541912cfcadcd8ade47363aa75d4fb80f1a0b712d88ad9fd11eea97_ppc64le |
| Red Hat | openshift4/ose-machine-config-operator@sha256:e0648d8cc1ee89c9378f67c0caf0b15c788094dc7f32d64bc0841f1653d1128b_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-machine-config-operator@sha256:e0648d8cc1ee89c9378f67c0caf0b15c788094dc7f32d64bc0841f1653d1128b_s390x |
| Red Hat | openshift4/ose-openshift-controller-manager-rhel9@sha256:aa9d4271e65286c60578ce2e3940071b1379e75a896dba40774163584bab0d5d_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | * |
| Red Hat | openshift4/ose-pod-rhel9@sha256:e69ccab31cccae506a7ed7518026b0481ca039d748cb1b240556a3d1acfcdb35_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-pod-rhel9@sha256:e69ccab31cccae506a7ed7518026b0481ca039d748cb1b240556a3d1acfcdb35_amd64 |
| Red Hat | openshift4/ose-console@sha256:b26146adbb150acabea098b6724054bc8ed4bc6e75cc08764f6aea855c0b8e08_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-console@sha256:b26146adbb150acabea098b6724054bc8ed4bc6e75cc08764f6aea855c0b8e08_s390x |
| Red Hat | openshift4/ose-hypershift-rhel9@sha256:a06bec747e5acc847d8b7faec047cded9de6a99859bd42fda5c23e054e87b37f_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-hypershift-rhel9@sha256:a06bec747e5acc847d8b7faec047cded9de6a99859bd42fda5c23e054e87b37f_s390x |
…and 32 more
Timeline
- Mar 19, 2024 CVE Published
- Apr 28, 2026 CVE Updated
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2024:1255 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2264336 issue
- https://issues.redhat.com/browse/OCPBUGS-24086 advisory
- https://issues.redhat.com/browse/OCPBUGS-25831 advisory
- https://issues.redhat.com/browse/OCPBUGS-29080 advisory
- https://issues.redhat.com/browse/OCPBUGS-29661 advisory
- https://issues.redhat.com/browse/OCPBUGS-30189 advisory
- https://issues.redhat.com/browse/OCPBUGS-30412 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1255.json advisory
- https://access.redhat.com/security/cve/CVE-2024-25620 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-25620 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25620 advisory
- https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503 advisory
- https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r advisory