SUSE-SU-2026:2823-1

Details

Description of the patch:

This update for helm fixes the following issues

Update to version 3.21.2
CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).

Affected Packages

helm

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

3.21.2-150000.1.80.1

helm-bash-completion

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

3.21.2-150000.1.80.1

helm-zsh-completion

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

3.21.2-150000.1.80.1

helm-fish-completion

SUSE Linux Enterprise Module for Package Hub 15 SP7

Fixed in:

3.21.2-150000.1.80.1

References

ADVISORY

https://bugzilla.suse.com/1266598

ADVISORY

https://bugzilla.suse.com/1270127

ADVISORY