CVE-2019-1000008 — Path Traversal in Helm

CWE-22 — Path Traversal5 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 54.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Helm.sh HelmHelm
Timeline
PublishedFeb 4
Latest updateAug 20

Description

All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDhelm/helm2.0.0 — 2.12.2
▶Gohelm.sh/helm2.0.0+incompatible — 2.12.2+incompatible+1

🔴Vulnerability Details

4
OSV
Helm Path Traversal in helm.sh/helm↗2024-08-20
▶
GHSA
Helm Path Traversal↗2022-05-14
▶
OSV
Helm Path Traversal↗2022-05-14
▶
CVEList
CVE-2019-1000008: All versions of Helm between Helm >=2↗2019-02-04
▶
CVE-2019-1000008 — Path Traversal in Helm.sh Helm | cvebase