CVE-2019-18658: Critical severity helm vulnerability
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.
Other sources
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18658?
The severity of CVE-2019-18658 is critical.
How does CVE-2019-18658 affect Helm?
CVE-2019-18658 affects Helm 2.x versions before 2.15.2.
What can a maliciously designed chart do in CVE-2019-18658?
A maliciously designed chart in CVE-2019-18658 can include sensitive content such as `/etc/passwd` or execute a denial of service (DoS) via a special file.
How can I fix CVE-2019-18658?
To fix CVE-2019-18658, upgrade Helm to version 2.15.2.
Where can I find more information about CVE-2019-18658?
You can find more information about CVE-2019-18658 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-18658), [Helm Security Notice](https://helm.sh/blog/2019-10-30-helm-symlink-security-notice/), [GitHub Advisory](https://github.com/advisories/GHSA-p5pc-m4q7-7qm9).