CVE-2020-15187: plugin.yaml file allows for duplicate entries in helm
(updated )
During a security audit of Helm’s code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin’s install hooks, causing a local execution attack.
To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).
References
- github.com/advisories/GHSA-c52f-pq47-2r9j
- github.com/helm/helm
- github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946
- github.com/helm/helm/commit/ac7c07c37d87e09797f714fb57aa5e9cb99d9450
- github.com/helm/helm/commit/b0296c0522e837d65f944beefa3fb64fd08ac304
- github.com/helm/helm/commit/c8d6b01d72c9604e43ee70d0d78fadd54c2d8499
- github.com/helm/helm/commit/d9ef5ce8bad512e325390c0011be1244b8380e4b
- github.com/helm/helm/commit/f2ede29480b507b7d8bb152dd8b6b86248b00658
- github.com/helm/helm/security/advisories/GHSA-c52f-pq47-2r9j
- nvd.nist.gov/vuln/detail/CVE-2020-15187
Code Behaviors & Features
Detect and mitigate CVE-2020-15187 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →