Helm v3.11.1 is a security (patch) release. Users are strongly recommended to update to this release.
The template function getHostByName can be used to disclose information. More details are available in the CVE.
This release introduces a breaking changes to Helm:
When using the helm client for the template, install, and upgrade commands there is a new flag. --enable-dns needs to be set for the getHostByName template function to attempt to lookup an IP address for a given hostname. If the flag is not set the template function will return an empty string and skip looping up an IP address for the host.
The Helm SDK has added the EnableDNS property to the install action, the upgrade action, and the Engine. This property must be set to true for the in order for the getHostByName template function to attempt to lookup an IP address.
The default for both of these cases is false.
Philipp Stehle at SAP disclosed the vulnerability to the Helm project.
Installation and Upgrading
Download Helm v3.11.1. The common platform binaries are here:
Linux amd64 (checksum / 0b1be96b66fab4770526f136f5f1a385a47c41923d33aab0dcb500e0f6c1bf7c)
Linux arm (checksum / 77b797134ea9a121f2ede9d159a43a8b3895a9ff92cc24b71b77fb726d9eba6d)
Linux arm64 (checksum / 919173e8fb7a3b54d76af9feb92e49e86d5a80c5185020bae8c393fa0f0de1e8)
Linux i386 (checksum / 1581a4ce9d0014c49a3b2c6421f048d5c600e8cceced636eb4559073c335af0b)
Linux ppc64le (checksum / 6ab8f2e253c115b17eda1e10e96d1637047efd315e9807bcb1d0d0bcad278ab7)
Linux s390x (checksum / ab133e6b709c8107dc4f8f62838947350adb8e23d76b8c2c592ff4c09bc956ef)
Windows amd64 (checksum / bc37d5d283e57c5dfa94f92ff704c8e273599ff8df3f8132cef5ca73f6a23d0a)
This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @mattfarinakeybase account. Please use the attached signatures for verifying this release using gpg.
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.
What's Next
3.11.2 is the next patch/bug fix release and will be on March 08, 2023.
3.12.0 is the next feature release and be on May 10, 2023.
Configuration
Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
Automerge: Disabled by config. Please merge this manually once you are satisfied.
Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.
Ignore: Close this MR and you won't be reminded about this update again.
If you want to rebase/retry this MR, check this box
