CVE-2020-4053
Low
Description
In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4.
SeverityLow
CVSS3.7
Exploit probability74. percentile1.5%
ProductHelm
PublishedJun 16, 2020
First seenJun 16, 2020
Weakness typeCWE-22Path traversal
How to fix
Update
- helm helm3.2.4 or later
- helm.sh/helm/v33.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| helm helm | 3.0.0 ≤ v < 3.2.4 | 3.2.4 |
| helm.sh/helm/v3Go | 3.0.0 ≤ v < 3.2.4 | 3.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.