CVE-2020-15185

Katalog CVE

CVSS 2.7 · Low EPSS 0,88%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada helm. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

Rincian

Terbit di NVD

17 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-694: Use of Multiple Resources with Duplicate Identifier

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc patch · advisory pihak ketiga
• https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453 advisory pihak ketiga