Aliases are never checked in Helm
CVE-2020-15184

3.7LOW

Key Information:

Vendor

Helm

Status
Helm
Vendor
CVE Published:
17 September 2020

What is CVE-2020-15184?

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.

Affected Version(s)

helm >= 2.0.0, < 2.16.11 < 2.0.0, 2.16.11

helm >= 3.0.0, < 3.3.2 < 3.0.0, 3.3.2

References

https://github.com/helm/helm/security/advisories/GHSA-9vp...
x_refsource_CONFIRM
https://github.com/helm/helm/commit/e7c281564d8306e1dcf80...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.