v2.16.11
Helm v2.16.11 is a security (patch) release. Users are strongly recommended to update to this release. It fixes four notable security issues for which we have opened security advisories. More information on the security advisory can be found on the security advisory page.
Most of the issues were discovered by Trail of Bits during their CNCF-sponsored audit of the Helm codebase. We are grateful for Trail of Bits' detailed and thorough analysis of the Helm codebase. In addition, a Helm core maintainer identified one more issue.
The community keeps growing, and we'd love to see you there!
- Join the discussion in Kubernetes Slack:
- for questions and just to hang out
- for discussing PRs, code, and bugs
- Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
- Test, debug, and contribute charts: GitHub/helm/charts
Notable Changes
The main security issues are:
- The plugin name field is not properly sanitized
- Alias names in Chart.yaml are not properly sanitized
- The index.yaml file for repositories is not parsed in strict mode, enabling duplicate entries
- The plugin.yaml file for repositories is not parsed in strict mode, enabling duplicate entries
Installation and Upgrading
Download Helm v2.16.11. The common platform binaries are here:
- MacOS amd64 (checksum / e29337c497b481edd5fc436f04182ae7e939a4783a50bdd4b5a5a07eb60a810f)
- Linux amd64 (checksum / 7eeb6c01cd0f25223c885887669b57cebaf7a0552cff94c748f1c28e4df55ce2)
- Linux arm (checksum / d47dbb1bc0dfc18affb051d5b4a5eafe8f68f2717a84849e86af5425efd69ead)
- Linux arm64 (checksum / a6baba468b732823488e4e564ea4857d1f013a1b7e597a36e6118bc736173e33)
- Linux i386 (checksum / b3515890601bddce52db3c13a7c1bceca41904d2fa2375e5c11a2218ab0ca537)
- Linux ppc64le (checksum / abb60635b042812a6997430d438c3cbde49e8816291608d5cbf835302001ae4c)
- Linux s390x (checksum / e29337c497b481edd5fc436f04182ae7e939a4783a50bdd4b5a5a07eb60a810f)
- Windows amd64 (checksum / e263f01a1e45a53aa9816aa8fc360bc8520cf448d7bf09fe30cca4e181acbe47)
This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.
What's Next
- v2.17.0 will be the LAST RELEASE of Helm v2
Changelog
- fix formatting error (#8758) 73b28ba (Matt Butcher)
- fix: use yaml annotations for yaml.v2 validation 077ffec (Matthew Fisher)
- validate plugin metadata before loading c8d6b01 (Matthew Fisher)
- backported fixes from helm3 6aab637 (Matt Butcher)
- Fixing broken vanity URL in dependencies a9337d8 (Matt Farina)