CVE-2019-1000008
Medium
Description
All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.
SeverityMedium
CVSS6.5
Exploit probability—
ProductHelm
PublishedFeb 4, 2019
First seenFeb 4, 2019
How to fix
Update
- helm helm2.12.2 or later
- helm.sh/helm2.12.2, 2.12.2+incompatible or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| helm helm | 2.0.0 ≤ v < 2.12.2 | 2.12.2 |
| helm.sh/helmGo | 2.0.0 ≤ v < 2.12.2, 2.0.0+incompatible ≤ v < 2.12.2+incompatible | 2.12.2, 2.12.2+incompatible |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.