CVE-2020-15185: Duplicated chart entries in Helm

Vulnerability summary

CVE-2020-15185 is a medium (CVSS 4.0) vulnerability in helm. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities.

Timeline

1. 17-09-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-694Use of Multiple Resources with Duplicate IdentifierThe product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.