SB2020091749 - Multiple vulnerabilities in Helm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020091749

SB2020091749 - Multiple vulnerabilities in Helm

Published: September 17, 2020 Updated: April 9, 2026

Security Bulletin ID SB2020091749
Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2020-15186)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when handling plugin names. A remote attacker can trick the victim into using a specially crafted plugin to spoof output of the helm --help command.


2) Input validation error (CVE-ID: CVE-2020-15184)

The vulnerability allows a remote attacker to inject unwanted information into a chart.

The vulnerability exists due to improper input validation in the alias field in Chart.yaml when processing chart dependencies. A remote attacker can supply a specially crafted chart to inject unwanted information into a chart.


3) Insufficient verification of data authenticity (CVE-ID: CVE-2020-15185)

The vulnerability allows a remote user to inject a malicious chart entry into a repository.

The vulnerability exists due to improper integrity control in the repository index file when processing duplicate c hart entries. A remote user can modify the index file so that a malicious duplicate chart entry is used to inject a malicious chart entry into a repository.

Exploitation requires write access to the index file and may occur during a machine-in-the-middle attack on a non-SSL connection.


4) Interpretation conflict (CVE-ID: CVE-2020-15187)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper handling of duplicate entries in plugin.yaml in Helm plugin installation hooks when processing a compromised plugin archive or repository content. A remote user can introduce duplicate plugin entries so that the last entry is used to execute arbitrary code.

Exploitation requires write access to the plugin git repository or the plug in archive while it is being downloaded.


Remediation

Install update from vendor's website.

References