GitHub Advisoryadvisory · Go

GHSA-9vp5-m38w-j776 Aliases are never checked in helm

LOW Published 2021-05-24 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-15184
Ecosystem
Go
Packages
helm.sh/helm/v3, helm.sh/helm
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20, CWE-74
Reviewed
2021-05-24

Affected packages

• Go helm.sh/helm/v3: >= 3.0.0, < 3.3.2 → fixed in 3.3.2 • Go helm.sh/helm: < 2.16.11 → fixed in 2.16.11

Description

Impact During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. Patches This issue has been patched in Helm 3.3.2 and 2.16.11 Specific Go Packages Affected helm.sh/helm/v3/pkg/chartutil Workarounds Manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

Related

Alias · CVE (1)

  • CVE-2020-15184 In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References