Security Bulletin: IBM Cloud Private is vulnerable to Helm vulnerabilities (CVE-2020-15187, CVE-2020-15186, CVE-2020-15185, CVE-2020-15184)

Summary IBM Cloud Private is vulnerable to Helm vulnerabilities Vulnerability Details CVEID: CVE-2020-15187 DESCRIPTION: Helm could allow a remote authenticated attacker to bypass security restrictions, caused by an issue with containing duplicates of the same entry in the plugin.yaml file. By...

Security fix for the ALT Linux 10 package helm version 3.4.1-alt1

Nov. 23, 2020 Aleksei Nikiforov 3.4.1-alt1 - Updated to upstream version 3.4.1 Fixes: CVE-2020-4053, CVE-2020-11013, CVE-2020-15184, CVE-2020-15185, CVE-2020-15186, CVE-2020-15187...

CVE-2020-15187

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform thi...

CVE-2020-15187

CVE-2020-15187 affects Helm plugins in Helm 2.16.11+ and 3.3.2+. The vulnerability arises when a plugin contains duplicates of the same entry in plugin.yaml, causing the last entry to be used. If a plugin is compromised, an attacker with write access to the plugin repository or archive during dow...