PT-2020-14258 · Helm+2 · Helm+2
Lowbacongobbler
·
Published
2020-09-17
·
Updated
2025-05-29
·
CVE-2020-15187
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Helm versions prior to 2.16.11
Helm versions prior to 3.3.2
Description
A Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded, which can occur during a MITM attack on a non-SSL connection.
Recommendations
For Helm versions prior to 2.16.11, update to version 2.16.11 or later.
For Helm versions prior to 3.3.2, update to version 3.3.2 or later.
As a temporary workaround, consider installing plugins using a secure connection protocol like SSL to minimize the risk of exploitation.
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Helm
Suse