CVE-2020-15187
Description
In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.
How to fix
- helm helm2.16.11, 3.3.2 or later
- helm.sh/helm/v33.3.2 or later
- helm.sh/helm2.16.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| helm helm | 2.0.0 ≤ v < 2.16.11, 3.0.0 ≤ v < 3.3.2 | 2.16.11, 3.3.2 |
| helm.sh/helm/v3Go | 3.0.0 ≤ v < 3.3.2 | 3.3.2 |
| helm.sh/helmGo | 2.0.0 ≤ v < 2.16.11 | 2.16.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.