GHSA-9vp5-m38w-j776LowCVSS 3.7

Aliases are never checked in helm

Published
May 24, 2021
Last Modified
October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-15184 →

📋 Description

Impact

During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart.

Patches

This issue has been patched in Helm 3.3.2 and 2.16.11

Specific Go Packages Affected

helm.sh/helm/v3/pkg/chartutil

Workarounds

Manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.

🎯 Affected products2

  • go/helm.sh/helm/v3:>= 3.0.0, < 3.3.2
  • go/helm.sh/helm:< 2.16.11

🔗 References (5)