PT-2020-14255 · Helm+2 · Helm+2

Published 2020-09-17 · Updated 2024-03-06 · CVE-2020-15184

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Helm versions prior to 2.16.11 Helm versions prior to 3.3.2

Description The issue is related to the alias field on a Chart.yaml not being properly sanitized, which could lead to the injection of unwanted information into a chart. This was identified during a security audit of Helm's code base.

Recommendations For Helm versions prior to 2.16.11, update to version 2.16.11 to resolve the issue. For Helm versions prior to 3.3.2, update to version 3.3.2 to resolve the issue. As a temporary workaround, consider manually reviewing the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-20

CWE-74

Related Identifiers

ALT-PU-2020-3396

ALT-PU-2020-3416

ALT-PU-2022-1250

BIT-HELM-2020-15184

CVE-2020-15184

GHSA-9VP5-M38W-J776

SUSE-SU-2020:3760-1

Affected Products

Alt Linux

Helm

Suse

References · 26

• https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850 · Patch
• https://osv.dev/vulnerability/GHSA-9vp5-m38w-j776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15184 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:3760-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15184 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-helm-2020-15184 · Vendor Advisory
• https://github.com/helm/helm · Note
• https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946 · Note
• https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776 · Note
• https://suse.com/security/cve/CVE-2020-15184 · Note
• https://bugzilla.suse.com/1174951 · Note
• https://bugzilla.suse.com/1176754 · Note
• https://suse.com/security/cve/CVE-2020-8565 · Note
• https://suse.com/security/cve/CVE-2020-15112 · Note
• https://bugzilla.suse.com/1176752 · Note