GitHub Advisoryadvisory · Go

GHSA-m54r-vrmv-hw33 Improper Sanitizing of plugin names in helm

LOW Published 2021-05-24 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-15186
Ecosystem
Go
Packages
helm.sh/helm/v3, helm.sh/helm
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
Weaknesses
CWE-20, CWE-74
Reviewed
2021-05-24

Affected packages

• Go helm.sh/helm/v3: >= 3.0.0, < 3.3.2 → fixed in 3.3.2 • Go helm.sh/helm: < 2.16.11 → fixed in 2.16.11

Description

Impact Security researchers at Trail of Bits discovered that plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. Specific Go Packages Affected helm.sh/helm/v3/pkg/plugin Patches This issue has been patched in Helm 3.3.2. Workarounds Do not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.

Related

Alias · CVE (1)

  • CVE-2020-15186 In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References