GHSA-c52f-pq47-2r9j BIT-helm-2020-15187 CVE-2020-15187
plugin.yaml file allows for duplicate entries in helm
- Severity
- 3.0 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 1.52%
- Chance of exploitation in the next 30 days. Higher than 74.55% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-694 Use of Multiple Resources with Duplicate Identifier
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack.
To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).
Patches
This issue has been patched in Helm 2.16.11 and Helm 3.3.2.
Workarounds
Make sure to install plugins using a secure connection protocol like SSL.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| helm.sh/helm | >= 2.0.0, < 2.16.11 |
2.16.11 |
| helm.sh/helm/v3 | >= 3.0.0, < 3.3.2 |
3.3.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
helm.sh/helm Go → 2.16.11
- go
go get helm.sh/helm@v2.16.11 && go mod tidy
helm.sh/helm/v3 Go → 3.3.2
- go
go get helm.sh/helm/v3@v3.3.2 && go mod tidy
Severity breakdown
CVSS 3.1 3.0
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-694: Use of Multiple Resources with Duplicate Identifier
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
How to prevent it
- Architecture and Design: Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Packages
Other links
- github.com/helm/helm/security/advisories/GHSA-c52f-pq47-2r9j
- github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946
- github.com/helm/helm/commit/ac7c07c37d87e09797f714fb57aa5e9cb99d9450
- github.com/helm/helm/commit/b0296c0522e837d65f944beefa3fb64fd08ac304
- github.com/helm/helm/commit/c8d6b01d72c9604e43ee70d0d78fadd54c2d8499
- github.com/helm/helm/commit/d9ef5ce8bad512e325390c0011be1244b8380e4b
- github.com/helm/helm/commit/f2ede29480b507b7d8bb152dd8b6b86248b00658
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment | Medium | Also affects helm.sh/helm/v3 |
| GHSA-f9f8-9pmf-xv68 Helm May Panic Due To Incorrect YAML Content | Medium | Also affects helm.sh/helm |
| GHSA-9h84-qmv7-982p Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion | Medium | Also affects helm.sh/helm |
| GHSA-557j-xg8c-q2mm Helm vulnerable to Code Injection through malicious chart.yaml content | High | Also affects helm.sh/helm/v3 |
| GHSA-5xqw-8hwv-wg92 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow | Medium | Also affects helm.sh/helm/v3 |
| GHSA-4hfp-h4cw-hj8p Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination | Medium | Also affects helm.sh/helm/v3 |
| GHSA-r53h-jv2g-vpx6 Helm's Missing YAML Content Leads To Panic | High | Also affects helm.sh/helm/v3 |
| GHSA-v53g-5gjp-272r Helm dependency management path traversal | Medium | Also affects helm.sh/helm/v3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor