GHSA-r53h-jv2g-vpx6 BIT-helm-2024-26147 CVE-2024-26147 GO-2024-2575
Helm's Missing YAML Content Leads To Panic
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.93%
- Chance of exploitation in the next 30 days. Higher than 60.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
3.14.2- Upgrade helm.sh/helm/v3 to this version or later
Description
A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.
Impact
When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.
In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.
Patches
This issue has been resolved in Helm v3.14.2.
Workarounds
If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.
If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.
For more information
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| helm.sh/helm/v3 | < 3.14.2 |
3.14.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
helm.sh/helm/v3 Go → 3.14.2
- go
go get helm.sh/helm/v3@v3.14.2 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
How to prevent it
- Implementation: Ensure that critical variables are initialized before first use [REF-1485].
- Build and Compilation: Most compilers will complain about the use of uninitialized variables if warnings are turned on.
- Implementation, Operation: When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
- Requirements: Choose a language that is not susceptible to these issues.
- Architecture and Design: Mitigating technologies such as safe string libraries and container abstractions could be introduced.
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment | Medium | Also affects helm.sh/helm/v3 |
| GHSA-f9f8-9pmf-xv68 Helm May Panic Due To Incorrect YAML Content | Medium | Also affects helm.sh/helm/v3 |
| GHSA-9h84-qmv7-982p Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion | Medium | Also affects helm.sh/helm/v3 |
| GHSA-557j-xg8c-q2mm Helm vulnerable to Code Injection through malicious chart.yaml content | High | Also affects helm.sh/helm/v3 |
| GHSA-5xqw-8hwv-wg92 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow | Medium | Also affects helm.sh/helm/v3 |
| GHSA-4hfp-h4cw-hj8p Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination | Medium | Also affects helm.sh/helm/v3 |
| GHSA-v53g-5gjp-272r Helm dependency management path traversal | Medium | Also affects helm.sh/helm/v3 |
| GHSA-pwcw-6f5g-gxf8 Helm vulnerable to information disclosure via getHostByName Function | Medium | Also affects helm.sh/helm/v3 |
Credits: Jakub Ciolek at AlphaSense
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor