CVE-2020-15186 — Improper Input Validation in Helm

CWE-20 — Improper Input ValidationCWE-74 — Injection6 documents6 sources
Severity
2.7LOWNVD
CNA3.4
EPSS
0.2%
top 53.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Helm.sh HelmHelm.sh Helm V3Helm
Timeline
PublishedSep 17
Latest updateMay 24

Description

In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages4 packages

▶NVDhelm/helm2.0.0 — 2.16.11+1
▶Gohelm.sh/helm< 2.16.11
▶Gohelm.sh/helm_v33.0.0 — 3.3.2
▶CVEListV5helm/helm>= 2.0.0, < 2.16.11, >= 3.0.0, < 3.3.2+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Improper Sanitizing of plugin names in helm↗2021-05-24
▶
GHSA
Improper Sanitizing of plugin names in helm↗2021-05-24
▶
CVEList
Improper sanitization of plugin names in Helm↗2020-09-17
▶

📋Vendor Advisories

1
Red Hat
helm: plugin names are not sanitized properly↗2020-09-18
▶

💬Community

1
Bugzilla
CVE-2020-15186 helm: plugin names are not sanitized properly↗2020-09-24
▶
CVE-2020-15186 — Improper Input Validation in Helm | cvebase