CVE-2020-15186: Improper sanitization of plugin names in Helm
Impact
Security researchers at Trail of Bits discovered that plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to helm --help.
Specific Go Packages Affected helm.sh/helm/v3/pkg/plugin
Patches
This issue has been patched in Helm 3.3.2.
Workarounds
Do not install untrusted Helm plugins. Examine the name field in the plugin.yaml file for a plugin, looking for characters outside of the [a-zA-Z0-9.-] range.
Other sources
In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to helm --help. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the name field in the plugin.yaml file for a plugin, looking for characters outside of the [a-zA-Z0-9.-] range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15186?
The severity of CVE-2020-15186 is medium.
How can a malicious plugin author exploit CVE-2020-15186?
A malicious plugin author could exploit CVE-2020-15186 by using characters in a plugin name that result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output.
Which versions of Helm are affected by CVE-2020-15186?
Helm versions 2.0.0 up to exclusive 2.16.11, and Helm v3 versions 3.0.0 up to and including 3.3.2 are affected by CVE-2020-15186.
How can I fix CVE-2020-15186?
To fix CVE-2020-15186, update Helm to version 2.16.11 for Helm v2, and update Helm v3 to version 3.3.2.
Where can I find more information about CVE-2020-15186?
You can find more information about CVE-2020-15186 on the official Helm GitHub security advisories page, the NVD website, and the Helm GitHub commit page.