CVE-2020-15184: Aliases are never checked in Helm
Impact
During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart.
Patches
This issue has been patched in Helm 3.3.2 and 2.16.11
Specific Go Packages Affected helm.sh/helm/v3/pkg/chartutil
Workarounds
Manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.
Other sources
In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15184?
The severity of CVE-2020-15184 is medium with a severity value of 3.7.
Which versions of Helm are affected by CVE-2020-15184?
Versions 2.0.0 to 2.16.11 of Helm and versions 3.0.0 to 3.3.2 of Helm v3 are affected by CVE-2020-15184.
How can I fix CVE-2020-15184?
To fix CVE-2020-15184, update Helm to version 2.16.11 or upgrade to Helm v3 version 3.3.2.
What is the impact of CVE-2020-15184?
The impact of CVE-2020-15184 is the potential injection of unwanted information into a chart due to improper sanitization of the `alias` field in a `Chart.yaml`.
Where can I find more information about CVE-2020-15184?
You can find more information about CVE-2020-15184 in the following references: [GitHub Security Advisory](https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-15184), [GitHub Commit](https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946).