CVE-2020-15185: Duplicated chart entries in Helm
First published: Thu Sep 17 2020(Updated: )
### Impact During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). ### Specific Go Packages Affected helm.sh/helm/v3/pkg/repo ### Patches This issue has been patched in Helm 3.3.2 and 2.16.11 ### Workarounds - do not install charts from repositories you do not trust - fetch charts using a secure channel of communication (such as TLS) - use `helm pull` to fetch the chart, then review the chart’s content (either manually, or with `helm verify` if it has been signed) to ensure it has not been tampered with - manually review the index file in the Helm repository cache before installing software.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Helm Helm | >=2.0.0<2.16.11 | |
| Helm Helm | >=3.0.0<3.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453
- https://nvd.nist.gov/vuln/detail/CVE-2020-15185
- https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc
- https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946
- https://github.com/advisories/GHSA-jm56-5h66-w453 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-15185.
What is the impact of this vulnerability?
The impact of this vulnerability is that a compromised Helm repository can contain duplicates of the same chart, allowing an attacker to lower the level of access.
Which versions of Helm are affected?
Helm versions 2.0.0 up to but excluding 2.16.11, and Helm versions 3.0.0 up to but excluding 3.3.2 are affected.
What is the severity of CVE-2020-15185?
CVE-2020-15185 has a severity rating of medium (2.7).
How can I fix this vulnerability?
To fix this vulnerability, upgrade to Helm version 2.16.11 or Helm version 3.3.2.
- collector/github-advisory-latest
- alias/GHSA-jm56-5h66-w453
- alias/CVE-2020-15185
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/author
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- package-manager/go
- vendor/helm
- canonical/helm helm
- version/helm helm/2.0.0
- version/helm helm/3.0.0