CVE-2020-15185
Description
In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.
How to fix
- helm helm2.16.11, 3.3.2 or later
- helm.sh/helm/v33.3.2 or later
- helm.sh/helm2.16.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| helm helm | 2.0.0 ≤ v < 2.16.11, 3.0.0 ≤ v < 3.3.2 | 2.16.11, 3.3.2 |
| helm.sh/helm/v3Go | 3.0.0 ≤ v < 3.3.2 | 3.3.2 |
| helm.sh/helmGo | v < 2.16.11 | 2.16.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.