CVE-2019-18658: Improper Link Resolution Before File Access ('Link Following')

May 24, 2022 (updated September 26, 2023)

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.

References

github.com/advisories/GHSA-p5pc-m4q7-7qm9
helm.sh/blog/2019-10-30-helm-symlink-security-notice/
nvd.nist.gov/vuln/detail/CVE-2019-18658

Code Behaviors & Features

Detect and mitigate CVE-2019-18658 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →