PT-2021-14402 · Helm+1 · Helm+1

Technosophos · Published 2021-02-05 · Updated 2024-03-06 · CVE-2021-21303

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Helm versions 3.0 through 3.5.2

Description: Helm, a tool for managing Charts in Kubernetes, has cases where data loaded from potentially untrusted sources was not properly sanitized. This includes invalid SemVer in the version field of a chart, unsanitized fields in Helm repository index.yaml files, plugin.yaml files for plugins, and Chart.yaml files. By exploiting these, attackers could send deceptive information to a terminal screen running the helm command, obscure or alter information on the screen, or execute higher-order logic like clearing a terminal screen. The issue affects Helm 3 and has been resolved by enforcing SemVer2 policies on version fields.

Recommendations: For Helm versions 3.0 through 3.5.2, upgrade to version 3.5.2 or later to resolve the issue. Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2022-3299

ALT-PU-2022-3302

AZL-6470

BIT-HELM-2021-21303

CVE-2021-21303

GHSA-C38G-469G-CMGX

GO-2022-1040

Affected Products

Alt Linux

Helm

References · 16

• https://github.com/helm/helm/commit/6ce9ba60b73013857e2e7c73d3f86ed70bc1ac9a · Patch
• https://osv.dev/vulnerability/CVE-2021-21303 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21303 · Security Note
• https://ubuntu.com/security/CVE-2021-21303 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-helm-2021-21303 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21303 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6470 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c38g-469g-cmgx · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21303 · Security Note
• https://github.com/helm/helm · Note
• https://github.com/helm/helm/security/advisories/GHSA-c38g-469g-cmgx · Note
• https://github.com/helm/helm/releases/tag/v3.5.2 · Note
• https://pkg.go.dev/vuln/GO-2022-1040 · Note
• https://github.com/advisories/GHSA-c38g-469g-cmgx · Note