Uninitialized Variable Vulnerability in Helm Prior to v3.14.2

CVE-2024-26147

What is CVE-2024-26147?

The Helm package manager, widely used for managing Kubernetes applications, is affected by an uninitialized variable vulnerability in versions prior to 3.14.2. This issue can manifest when parsing index.yaml or plugin.yaml files lacking the necessary metadata, resulting in a panic during execution. This vulnerability impacts the Helm SDK, particularly in functions like LoadIndexFile, DownloadIndexFile, and LoadDir, which are essential for managing Helm repositories and plugins. When a harmful plugin is introduced, it can disrupt all Helm client commands by causing panics during execution. The vulnerability has been addressed in Helm version 3.14.2, and users of earlier versions are advised to remove any malicious plugins manually and implement recovery mechanisms to handle potential panics.

References