GHSA-f9f8-9pmf-xv68 Helm May Panic Due To Incorrect YAML Content

• Go helm.sh/helm/v3: < 3.18.5 → fixed in 3.18.5

A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic. Impact There are two areas of YAML validation that were impacted. First, when a `Chart.yaml` file had a `null` maintainer or the `child` or `parent` of a dependencies `import-values` could be parsed as something other than a string, `helm lint` would panic. Second, when an `index.yaml` had an empty entry in the list of chart versions Helm would panic on interactions with that repository. Patches This issue has been resolved in Helm v3.18.5. Workarounds Ensure YAML files are formatted as Helm expects prior to processing them with Helm. References Helm's security policy is spelled out in detail in our SECURITY document. Credits Disclosed by Jakub Ciolek at AlphaSense.