Vulnerability-Lookup

CVE-2020-15185 (GCVE-0-2020-15185)

Vulnerability from cvelistv5 – Published: 2020-09-17 21:30 – Updated: 2024-08-04 13:08

Title

Duplicated chart entries in Helm

Summary

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

Severity

2.2 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-694 - {"CWE-694":"Use of Multiple Resources with Duplicate Identifier"}
CWE-74 - {"CWE-74":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/helm/helm/security/advisories/…	x_refsource_CONFIRM
https://github.com/helm/helm/commit/055dd41cbe53c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
helm	helm	Affected: >= 2.0.0, < 2.16.11 Affected: >= 3.0.0, < 3.3.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.474Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "helm",
          "vendor": "helm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.16.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-694",
              "description": "{\"CWE-694\":\"Use of Multiple Resources with Duplicate Identifier\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "{\"CWE-74\":\"Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-17T21:30:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
        }
      ],
      "source": {
        "advisory": "GHSA-jm56-5h66-w453",
        "discovery": "UNKNOWN"
      },
      "title": "Duplicated chart entries in Helm",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15185",
          "STATE": "PUBLIC",
          "TITLE": "Duplicated chart entries in Helm"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "helm",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 2.0.0, \u003c 2.16.11"
                          },
                          {
                            "version_value": "\u003e= 3.0.0, \u003c 3.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "helm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-694\":\"Use of Multiple Resources with Duplicate Identifier\"}"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-74\":\"Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
              "refsource": "CONFIRM",
              "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
            },
            {
              "name": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc",
              "refsource": "MISC",
              "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-jm56-5h66-w453",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15185",
    "datePublished": "2020-09-17T21:30:13.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-15185",
      "date": "2026-10-01",
      "epss": "0.00883",
      "percentile": "0.57709"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "455BCCE5-1D43-4E59-9591-E84B52DAAF0B",
                  "versionEndExcluding": "2.16.11",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B462D769-3FC0-4079-8B48-863F013662EF",
                  "versionEndExcluding": "3.3.2",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
        },
        {
          "lang": "es",
          "value": "En Helm versiones anteriores a 2.16.11 y 3.3.2, un repositorio de Helm puede contener duplicados del mismo gr\u00e1fico, y siempre se usa el \u00faltimo.\u0026#xa0;Si un repositorio est\u00e1 comprometido, esto reduce el nivel de acceso que necesita un atacante para inyectar un gr\u00e1fico incorrecto en un repositorio.\u0026#xa0;Para llevar a cabo este ataque, un atacante necesita tener acceso de escritura al archivo de index (lo que puede ocurrir durante un ataque MITM en una conexi\u00f3n no SSL).\u0026#xa0;Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11.\u0026#xa0;Una posible soluci\u00f3n es revisar manualmente el archivo  index en la cach\u00e9 del repositorio de Helm antes de instalar el software"
        }
      ],
      "id": "CVE-2020-15185",
      "lastModified": "2024-11-21T05:05:01.830",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "NONE",
              "baseScore": 4.0,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 2.2,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 0.7,
            "impactScore": 1.4,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 2.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 1.2,
            "impactScore": 1.4,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2020-09-17T22:15:12.443",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-74"
            },
            {
              "lang": "en",
              "value": "CWE-694"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-Other"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "455BCCE5-1D43-4E59-9591-E84B52DAAF0B",
                    "versionEndExcluding": "2.16.11",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B462D769-3FC0-4079-8B48-863F013662EF",
                    "versionEndExcluding": "3.3.2",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
          },
          {
            "lang": "es",
            "value": "En Helm versiones anteriores a 2.16.11 y 3.3.2, un repositorio de Helm puede contener duplicados del mismo gr\u00e1fico, y siempre se usa el \u00faltimo.\u0026#xa0;Si un repositorio est\u00e1 comprometido, esto reduce el nivel de acceso que necesita un atacante para inyectar un gr\u00e1fico incorrecto en un repositorio.\u0026#xa0;Para llevar a cabo este ataque, un atacante necesita tener acceso de escritura al archivo de index (lo que puede ocurrir durante un ataque MITM en una conexi\u00f3n no SSL).\u0026#xa0;Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11.\u0026#xa0;Una posible soluci\u00f3n es revisar manualmente el archivo  index en la cach\u00e9 del repositorio de Helm antes de instalar el software"
          }
        ],
        "id": "CVE-2020-15185",
        "lastModified": "2024-11-21T05:05:01.830",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 2.2,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.7,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 2.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-09-17T22:15:12.443",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              },
              {
                "lang": "en",
                "value": "CWE-694"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-02-23T18:21:51+00:00",
      "cve": "CVE-2020-15185",
      "id": "CVE-2020-15185",
      "initial_release_date": "2020-09-18T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "helm: write access to the index file allows an attacker to inject  bad chart into  repository",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-15185.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2025-08-18T02:17:51Z",
      "cve": "CVE-2020-15185",
      "id": "CVE-2020-15185",
      "initial_release_date": "2023-02-15T03:57:01Z",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "33",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-15185",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-15185.json",
      "version": "11"
    }
  }
}

bit-helm-2020-15185

Vulnerability from bitnami_vulndb

Published

2024-03-06 10:55

Modified

2026-09-08 08:34

Summary

Duplicated chart entries in Helm

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "helm",
        "purl": "pkg:bitnami/helm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.16.11"
            },
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15185"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*"
    ],
    "severity": "Low"
  },
  "details": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.",
  "id": "BIT-helm-2020-15185",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T10:55:08.169Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15185"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Duplicated chart entries in Helm"
}

CNVD-2020-59705

Vulnerability from cnvd - Published: 2020-10-30

Title

Helm注入漏洞

Description

helm是一款Kubernetes包管理器。 Helm 2.16.11之前版本和3.3.2版本存在注入漏洞，该漏洞源于用户输入构造命令、数据结构或记录的操作过程中，网络系统或产品缺乏对用户输入数据的正确验证，未过滤或未正确过滤掉其中的特殊元素，导致系统或产品产生解析或解释方式错误。远程攻击者可通过发送特制的SQL语句利用该漏洞在后台数据库中查看、添加、修改或删除后端数据库中的信息。

Severity

中

Patch Name

Helm注入漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-15185

Impacted products

Name
['helm helm <2.16.11', 'helm helm 3.3.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-15185",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-15185"
    }
  },
  "description": "helm\u662f\u4e00\u6b3eKubernetes\u5305\u7ba1\u7406\u5668\u3002\n\nHelm 2.16.11\u4e4b\u524d\u7248\u672c\u548c3.3.2\u7248\u672c\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7528\u6237\u8f93\u5165\u6784\u9020\u547d\u4ee4\u3001\u6570\u636e\u7ed3\u6784\u6216\u8bb0\u5f55\u7684\u64cd\u4f5c\u8fc7\u7a0b\u4e2d\uff0c\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u7f3a\u4e4f\u5bf9\u7528\u6237\u8f93\u5165\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\uff0c\u672a\u8fc7\u6ee4\u6216\u672a\u6b63\u786e\u8fc7\u6ee4\u6389\u5176\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\uff0c\u5bfc\u81f4\u7cfb\u7edf\u6216\u4ea7\u54c1\u4ea7\u751f\u89e3\u6790\u6216\u89e3\u91ca\u65b9\u5f0f\u9519\u8bef\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684SQL\u8bed\u53e5\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u540e\u53f0\u6570\u636e\u5e93\u4e2d\u67e5\u770b\u3001\u6dfb\u52a0\u3001\u4fee\u6539\u6216\u5220\u9664\u540e\u7aef\u6570\u636e\u5e93\u4e2d\u7684\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-59705",
  "openTime": "2020-10-30",
  "patchDescription": "helm\u662f\u4e00\u6b3eKubernetes\u5305\u7ba1\u7406\u5668\u3002\r\n\r\nHelm 2.16.11\u4e4b\u524d\u7248\u672c\u548c3.3.2\u7248\u672c\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7528\u6237\u8f93\u5165\u6784\u9020\u547d\u4ee4\u3001\u6570\u636e\u7ed3\u6784\u6216\u8bb0\u5f55\u7684\u64cd\u4f5c\u8fc7\u7a0b\u4e2d\uff0c\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u7f3a\u4e4f\u5bf9\u7528\u6237\u8f93\u5165\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\uff0c\u672a\u8fc7\u6ee4\u6216\u672a\u6b63\u786e\u8fc7\u6ee4\u6389\u5176\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\uff0c\u5bfc\u81f4\u7cfb\u7edf\u6216\u4ea7\u54c1\u4ea7\u751f\u89e3\u6790\u6216\u89e3\u91ca\u65b9\u5f0f\u9519\u8bef\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684SQL\u8bed\u53e5\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u540e\u53f0\u6570\u636e\u5e93\u4e2d\u67e5\u770b\u3001\u6dfb\u52a0\u3001\u4fee\u6539\u6216\u5220\u9664\u540e\u7aef\u6570\u636e\u5e93\u4e2d\u7684\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Helm\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "helm helm \u003c2.16.11",
      "helm helm 3.3.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-15185",
  "serverity": "\u4e2d",
  "submitTime": "2020-09-18",
  "title": "Helm\u6ce8\u5165\u6f0f\u6d1e"
}

FKIE_CVE-2020-15185

Vulnerability from fkie_nvd - Published: 2020-09-17 22:15 - Updated: 2026-06-17 02:56

Severity

2.2 (Low) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453	Third Party Advisory

Impacted products

	Vendor	Product	Version
	helm	helm	*
	helm	helm	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "helm",
          "vendor": "helm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.16.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "455BCCE5-1D43-4E59-9591-E84B52DAAF0B",
              "versionEndExcluding": "2.16.11",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B462D769-3FC0-4079-8B48-863F013662EF",
              "versionEndExcluding": "3.3.2",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
    },
    {
      "lang": "es",
      "value": "En Helm versiones anteriores a 2.16.11 y 3.3.2, un repositorio de Helm puede contener duplicados del mismo gr\u00e1fico, y siempre se usa el \u00faltimo.\u0026#xa0;Si un repositorio est\u00e1 comprometido, esto reduce el nivel de acceso que necesita un atacante para inyectar un gr\u00e1fico incorrecto en un repositorio.\u0026#xa0;Para llevar a cabo este ataque, un atacante necesita tener acceso de escritura al archivo de index (lo que puede ocurrir durante un ataque MITM en una conexi\u00f3n no SSL).\u0026#xa0;Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11.\u0026#xa0;Una posible soluci\u00f3n es revisar manualmente el archivo  index en la cach\u00e9 del repositorio de Helm antes de instalar el software"
    }
  ],
  "id": "CVE-2020-15185",
  "lastModified": "2026-06-17T02:56:13.187",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.2,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-17T22:15:12.443",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-694"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JM56-5H66-W453

Vulnerability from github – Published: 2021-05-24 16:57 – Updated: 2023-10-02 13:35

Summary

Repository index file allows for duplicates of the same chart entry in helm

Details

Impact

During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.

To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).

Specific Go Packages Affected

helm.sh/helm/v3/pkg/repo

Patches

This issue has been patched in Helm 3.3.2 and 2.16.11

Workarounds

do not install charts from repositories you do not trust
fetch charts using a secure channel of communication (such as TLS)
use helm pull to fetch the chart, then review the chart’s content (either manually, or with helm verify if it has been signed) to ensure it has not been tampered with
manually review the index file in the Helm repository cache before installing software.

Severity

2.2 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "helm.sh/helm/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "helm.sh/helm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.16.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15185"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-694",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-24T16:47:58Z",
    "nvd_published_at": "2020-09-17T22:15:00Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nDuring a security audit of Helm\u0027s code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.\n\nTo perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).\n\n### Specific Go Packages Affected\nhelm.sh/helm/v3/pkg/repo\n\n### Patches\n\nThis issue has been patched in Helm 3.3.2 and 2.16.11\n\n### Workarounds\n\n- do not install charts from repositories you do not trust\n- fetch charts using a secure channel of communication (such as TLS)\n- use `helm pull` to fetch the chart, then review the chart\u2019s content (either manually, or with `helm verify` if it has been signed) to ensure it has not been tampered with\n- manually review the index file in the Helm repository cache before installing software.",
  "id": "GHSA-jm56-5h66-w453",
  "modified": "2023-10-02T13:35:50Z",
  "published": "2021-05-24T16:57:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Repository index file allows for duplicates of the same chart entry in helm"
}

GSD-2020-15185

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-15185

Aliases

CVE-2020-15185

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-15185",
    "description": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.",
    "id": "GSD-2020-15185",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-15185.html",
      "https://access.redhat.com/errata/RHEA-2021:0729"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-15185"
      ],
      "details": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.",
      "id": "GSD-2020-15185",
      "modified": "2023-12-13T01:21:43.243675Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-15185",
        "STATE": "PUBLIC",
        "TITLE": "Duplicated chart entries in Helm"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "helm",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 2.0.0, \u003c 2.16.11"
                        },
                        {
                          "version_value": "\u003e= 3.0.0, \u003c 3.3.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "helm"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.2,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "{\"CWE-694\":\"Use of Multiple Resources with Duplicate Identifier\"}"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "{\"CWE-74\":\"Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
            "refsource": "CONFIRM",
            "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
          },
          {
            "name": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc",
            "refsource": "MISC",
            "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-jm56-5h66-w453",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.16.11",
          "affected_versions": "All versions before 2.16.11",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-694",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2021-05-24",
          "description": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.",
          "fixed_versions": [
            "2.16.11"
          ],
          "identifier": "CVE-2020-15185",
          "identifiers": [
            "GHSA-jm56-5h66-w453",
            "CVE-2020-15185"
          ],
          "not_impacted": "All versions starting from 2.16.11",
          "package_slug": "go/helm.sh/helm",
          "pubdate": "2021-05-24",
          "solution": "Upgrade to version 2.16.11 or above.",
          "title": "Use of Multiple Resources with Duplicate Identifier",
          "urls": [
            "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15185",
            "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc",
            "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946",
            "https://github.com/advisories/GHSA-jm56-5h66-w453"
          ],
          "uuid": "421db958-31e7-47f2-967e-d8bdcc2276e5"
        },
        {
          "affected_range": "\u003e=3.0.0 \u003c3.3.2",
          "affected_versions": "All versions starting from 3.0.0 before 3.3.2",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-694",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2021-05-24",
          "description": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.",
          "fixed_versions": [
            "3.3.2"
          ],
          "identifier": "CVE-2020-15185",
          "identifiers": [
            "GHSA-jm56-5h66-w453",
            "CVE-2020-15185"
          ],
          "not_impacted": "All versions before 3.0.0, all versions starting from 3.3.2",
          "package_slug": "go/helm.sh/helm/v3",
          "pubdate": "2021-05-24",
          "solution": "Upgrade to version 3.3.2 or above.",
          "title": "Use of Multiple Resources with Duplicate Identifier",
          "urls": [
            "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15185",
            "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc",
            "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946",
            "https://github.com/advisories/GHSA-jm56-5h66-w453"
          ],
          "uuid": "3e0b72ac-a118-4126-a119-a92e1735c3a1"
        },
        {
          "affected_range": "\u003e=2.0.0 \u003c2.16.11||\u003e=3.0.0 \u003c3.3.2",
          "affected_versions": "All versions starting from 2.0.0 before 2.16.11, all versions starting from 3.0.0 before 3.3.2",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-694",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2021-05-24",
          "description": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.",
          "fixed_versions": [
            "2.16.11",
            "3.3.2"
          ],
          "identifier": "CVE-2020-15185",
          "identifiers": [
            "GHSA-jm56-5h66-w453",
            "CVE-2020-15185"
          ],
          "not_impacted": "All versions before 2.0.0, all versions starting from 2.16.11 before 3.0.0, all versions starting from 3.3.2",
          "package_slug": "go/helm.sh/helm/v3/pkg/repo",
          "pubdate": "2021-05-24",
          "solution": "Upgrade to versions 2.16.11, 3.3.2 or above.",
          "title": "Use of Multiple Resources with Duplicate Identifier",
          "urls": [
            "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15185",
            "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc",
            "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946",
            "https://github.com/advisories/GHSA-jm56-5h66-w453"
          ],
          "uuid": "4b90b90b-5a69-4b8f-98e8-e140f767319e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.3.2",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.16.11",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15185"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
            },
            {
              "name": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2022-08-05T19:31Z",
      "publishedDate": "2020-09-17T22:15Z"
    }
  }
}

RHEA-2021:0729

Vulnerability from csaf_redhat - Published: 2021-03-04 15:08 - Updated: 2026-06-26 22:49

Summary

Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15185.

CVE-2020-15185

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Fixed: 78 products

https://access.redhat.com/errata/RHEA-2021:0729

Open the full advisory

RHEA-2021_0729

Vulnerability from csaf_redhat - Published: 2021-03-04 15:08 - Updated: 2024-11-22 15:58

Summary

Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15185.

CVE-2020-15185

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Fixed: 78 products

https://access.redhat.com/errata/RHEA-2021:0729

Open the full advisory

SUSE-SU-2020:3760-1

Vulnerability from csaf_suse - Published: 2020-12-23 08:18 - Updated: 2026-09-20 13:45

Summary

Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15185.

CVE-2020-15185

2.2 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Recommended: 16 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-15185 (GCVE-0-2020-15185)

Vulnerability from bitnami_vulndb

Impact

Specific Go Packages Affected

Patches

Workarounds

Tags

Sightings

Nomenclature

Related by attack behaviour