// For flags

CVE-2020-15185

Duplicated chart entries in Helm

Severity Score

2.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

En Helm versiones anteriores a 2.16.11 y 3.3.2, un repositorio de Helm puede contener duplicados del mismo gráfico, y siempre se usa el último. Si un repositorio está comprometido, esto reduce el nivel de acceso que necesita un atacante para inyectar un gráfico incorrecto en un repositorio. Para llevar a cabo este ataque, un atacante necesita tener acceso de escritura al archivo de index (lo que puede ocurrir durante un ataque MITM en una conexión no SSL). Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11. Una posible solución es revisar manualmente el archivo index en la caché del repositorio de Helm antes de instalar el software

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-06-25 CVE Reserved
  • 2020-09-17 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-694: Use of Multiple Resources with Duplicate Identifier
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Helm
Search vendor "Helm"
 Helm
Search vendor "Helm" for product "Helm"
 >= 2.0.0 < 2.16.11
Search vendor "Helm" for product "Helm" and version " >= 2.0.0 < 2.16.11"
-
Affected
Helm
Search vendor "Helm"
 Helm
Search vendor "Helm" for product "Helm"
 >= 3.0.0 < 3.3.2
Search vendor "Helm" for product "Helm" and version " >= 3.0.0 < 3.3.2"
-
Affected