Low severityNVD Advisory· Published Sep 17, 2020· Updated Aug 4, 2024
Aliases are never checked in Helm
CVE-2020-15184
Description
In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
helm.sh/helm/v3Go | >= 3.0.0, < 3.3.2 | 3.3.2 |
helm.sh/helmGo | < 2.16.11 | 2.16.11 |
Affected products
5- osv-coords4 versionspkg:bitnami/helmpkg:golang/helm.sh/helmpkg:golang/helm.sh/helm/v3pkg:rpm/suse/kubernetes&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP1
>= 2.0.0, < 2.16.11+ 3 more
- (no CPE)range: >= 2.0.0, < 2.16.11
- (no CPE)range: < 2.16.11
- (no CPE)range: >= 3.0.0, < 3.3.2
- (no CPE)range: < 1.17.13-4.21.2
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-9vp5-m38w-j776ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15184ghsaADVISORY
- github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946ghsaWEB
- github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850ghsax_refsource_MISCWEB
- github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.