CVE-2020-4053 Path Traversal in Helm Plugin Archive

In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended director...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview helm.sh/helm/v3/pkg/plugin/installer is a Kubernetes Package Manager. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. When installing Helm plugins from a tar archive over HTTP, it is possible for a malicious plugin author to injec...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/helm/helm/pkg/plugin/installer is a Kubernetes Package Manager. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. When installing Helm plugins from a tar archive over HTTP, it is possible for a malicious plugin author to...

PT-2020-17854 · Helm +1 · Helm +1

Name of the Vulnerable Software and Affected Versions: Helm versions 3.0.0 through 3.2.3 Description: A path traversal attack is possible when installing Helm plugins from a tar archive over HTTP, allowing a malicious plugin author to inject a relative path into a plugin archive and copy a file...

Information Disclosure

github.com/helm/helm is susceptible to information disclosure. When Helm template lookup function is run, it no longer restricts to not to make a call to the cluster during the helm template and helm install|update|delete|rollback --dry-run without any notification to the user, allowing it to che...

helm information disclosure vulnerability

helm is a Kubernetes package manager. An information disclosure vulnerability exists in helm versions 3.1.0 through 3.1.2. An attacker can exploit the vulnerability to obtain information about queries to the cluster...

CVE-2020-11013

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. lookup is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be us...

CVE-2020-11013

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. lookup is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be us...

Information disclosure

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. lookup is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be us...

UBUNTU-CVE-2020-11013

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. lookup is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be us...

CVE-2020-11013

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. lookup is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be us...

CVE-2020-11013

The CVE-2020-11013 issue affects Helm before 3.2.0, where the template function lookup can perform cluster lookups during helm template, helm install/update/delete/rollback --dry-run, potentially disclosing information from the cluster via template output. Helm 2 is unaffected. The root cause is ...

CVE-2020-11013 lookup Function Information Discolosure in Helm

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. lookup is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be us...

PT-2020-12493 · Helm +1 · Helm +1

Name of the Vulnerable Software and Affected Versions: Helm versions 3.0.0 through 3.1.2 Description: There is an information disclosure issue in Helm. The lookup template function, introduced in Helm v3, can lookup resources in the cluster to check for the existence of specific resources and get...

Symlink Attack

github.com/helm/helm is vulnerable to symlink attack. During loading or packaging of a chart as a directory, a malicious chart containing symlinks could be used to obtain system files such as /etc/passwd. The vulnerability can also be used to cause a denial of service condition when special files...

CVE-2019-18658

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...

CVE-2019-18658

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...

Design/Logic Flaw

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...

CVE-2019-18658

The CVE-2019-18658 issue concerns Helm 2.x before 2.15.2, where commands loading a chart as a directory or packaging could be exploited by a malicious chart to leak sensitive content (e.g., /etc/passwd) or trigger DoS via symlinks to files like /dev/urandom. It is described as a client‑side issue...

CVE-2019-18658

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...