Helm Unsafe Link Following

2022-05-2422:01:14

Google

osv.dev

helm security issue directory symlinks dos tiller client software

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.