// For flags

CVE-2020-15184

Aliases are never checked in Helm

Severity Score

2.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

En Helm versiones anteriores a 2.16.11 y 3.3.2, se presenta un error en el que el campo "alias" en un archivo "Chart.yaml" no es saneado apropiadamente. Esto podría conllevar a la inyección de información no deseada en un gráfico. Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11. Una posible solución es revisar manualmente que el campo "dependencies" de cualquier gráfico no sea de confianza, verificando que el campo "alias" no sea usado o (si se utiliza) no contenga nuevas líneas o caracteres de ruta

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-06-25 CVE Reserved
  • 2020-09-17 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Helm
Search vendor "Helm"
 Helm
Search vendor "Helm" for product "Helm"
 >= 2.0.0 < 2.16.11
Search vendor "Helm" for product "Helm" and version " >= 2.0.0 < 2.16.11"
-
Affected
Helm
Search vendor "Helm"
 Helm
Search vendor "Helm" for product "Helm"
 >= 3.0.0 < 3.3.2
Search vendor "Helm" for product "Helm" and version " >= 3.0.0 < 3.3.2"
-
Affected