Bug 1882302 (CVE-2020-15186) - CVE-2020-15186 helm: plugin names are not sanitized properly
Summary: CVE-2020-15186 helm: plugin names are not sanitized properly
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-15186
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1884135
Blocks: 1882307
TreeView+ depends on / blocked
 
Reported: 2020-09-24 09:42 UTC by Dhananjay Arunesh
Modified: 2021-12-15 02:51 UTC (History)
15 users (show)

Fixed In Version: helm 3.3.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-28 05:03:40 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-09-24 09:42:49 UTC 
In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.

References:
https://github.com/helm/helm/commit/809e2d999e2c33e20e77f6bff30652d79c287542
https://github.com/helm/helm/security/advisories/GHSA-m54r-vrmv-hw33
Note You need to log in before you can comment on or make changes to this bug.