CVE-2020-15185

Description

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

CVSS Metrics

• v3.1•LOW•Score: 2.2CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
• v3.1•LOW•Score: 2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
• v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.23%• Percentile: 46%

Techniques & Countermeasures

• CWE-694•Use of Multiple Resources with Duplicate Identifier

  The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

• CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

• helm.sh•helm

  < 2.16.11

• helm.sh/helm•v3

  ≥ 3.0.0, < 3.3.2

• helm•helm

  ≥ 2.0.0, < 2.16.11 | ≥ 3.0.0, < 3.3.2

References (4)

• https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453
• https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc
• https://nvd.nist.gov/vuln/detail/CVE-2020-15185
• https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946