medium
6.8
CWE
74
Advisory Published
Advisory Published
Updated

CVE-2021-21303: Injection attack in Helm

First published: Fri Feb 05 2021(Updated: )

Since Helm 2 was released, a well-documented aspect of Helm is that the Helm chart's version number MUST follow the SemVer2 specification. In the past, Helm would not permit charts with malformed versions. At some point, a patch was merged that changed this - On a version parse error, the version number was simply passed along as-is. This provided a vector for malicious data to be injected into Helm and potentially used in various ways. Core maintainers were able to send deceptive information to a terminal screen running the `helm` command, as well as obscure or alter information on the screen. In some cases, we could send codes that terminals used to execute higher-order logic, like clearing a terminal screen. Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields. All users of the Helm 3 should upgrade. Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data. ### Patches This issue has been resolved in Helm 3.5.2. While this fix does not constitute a breaking change, as all field formatting is now enforced as documented, it is possible that charts that were mistakenly allowed (but invalid) may no longer be available in search indexes. Specifically, **malformed SemVer versions are no longer supported**. This has always been the documented case, but it is true that malformed versions were allowed. Note that this is the first security release since Helm 2's final deprecation. Helm 2 was not audited for vulnerability to this issue, and should be assumed vulnerable.

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Helm Helm>=3.0.0<3.5.2
go/helm.sh/helm/v3>=3.0.0<3.5.2
3.5.2
>=3.0.0<3.5.2

Remedy

https://github.com/helm/helm/commit/6ce9ba60b73013857e2e7c73d3f86ed70bc1ac9a

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2021-21303?

    CVE-2021-21303 is a vulnerability in Helm, the Kubernetes Package Manager, which allows a local authenticated attacker to bypass security restrictions.

  • What is Helm?

    Helm is open-source software used for managing Charts, which are packages of pre-configured Kubernetes resources.

  • What is the severity of CVE-2021-21303?

    The severity of CVE-2021-21303 is medium, with a CVSS score of 6.8.

  • How can an attacker exploit CVE-2021-21303?

    An attacker with local authenticated access can exploit CVE-2021-21303 to bypass security restrictions.

  • How can I fix CVE-2021-21303?

    To fix CVE-2021-21303, upgrade to Helm version 3.5.2 or later.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203