CVE-2020-15187: Duplicate plugin entries in Helm

Vulnerability summary

CVE-2020-15187 is a medium (CVSS 6.5) vulnerability in helm. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.5% of scored vulnerabilities.

Timeline

1. 17-09-2020
   PublishedVulnerability first disclosed.
2. 29-05-2025
   Last modifiedVulnerability information updated.

Description

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-694Use of Multiple Resources with Duplicate IdentifierThe product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.