Vulnerability-Lookup

CVE-2020-15184 (GCVE-0-2020-15184)

Vulnerability from cvelistv5 – Published: 2020-09-17 20:40 – Updated: 2024-08-04 13:08

Title

Aliases are never checked in Helm

Summary

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-20 - {"CWE-20":"Improper Input Validation"}

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/helm/helm/security/advisories/…	x_refsource_CONFIRM
https://github.com/helm/helm/commit/e7c281564d830…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
helm	helm	Affected: >= 2.0.0, < 2.16.11 Affected: >= 3.0.0, < 3.3.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.470Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "helm",
          "vendor": "helm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.16.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "{\"CWE-20\":\"Improper Input Validation\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-17T20:40:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
        }
      ],
      "source": {
        "advisory": "GHSA-9vp5-m38w-j776",
        "discovery": "UNKNOWN"
      },
      "title": "Aliases are never checked in Helm",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15184",
          "STATE": "PUBLIC",
          "TITLE": "Aliases are never checked in Helm"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "helm",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 2.0.0, \u003c 2.16.11"
                          },
                          {
                            "version_value": "\u003e= 3.0.0, \u003c 3.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "helm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-20\":\"Improper Input Validation\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
              "refsource": "CONFIRM",
              "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
            },
            {
              "name": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850",
              "refsource": "MISC",
              "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-9vp5-m38w-j776",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15184",
    "datePublished": "2020-09-17T20:40:12.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-15184",
      "date": "2026-10-02",
      "epss": "0.01029",
      "percentile": "0.6241"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "455BCCE5-1D43-4E59-9591-E84B52DAAF0B",
                  "versionEndExcluding": "2.16.11",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B462D769-3FC0-4079-8B48-863F013662EF",
                  "versionEndExcluding": "3.3.2",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
        },
        {
          "lang": "es",
          "value": "En Helm versiones anteriores a 2.16.11 y 3.3.2, se presenta un error en el que el campo \"alias\" en un archivo \"Chart.yaml\" no es saneado  apropiadamente.\u0026#xa0;Esto podr\u00eda conllevar a la inyecci\u00f3n de informaci\u00f3n no deseada en un gr\u00e1fico.\u0026#xa0;Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11.\u0026#xa0;Una posible soluci\u00f3n es revisar manualmente que el campo \"dependencies\" de cualquier gr\u00e1fico no sea de confianza, verificando que el campo \"alias\" no sea usado o (si se utiliza) no contenga nuevas l\u00edneas o caracteres de ruta"
        }
      ],
      "id": "CVE-2020-15184",
      "lastModified": "2024-11-21T05:05:01.673",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "NONE",
              "baseScore": 4.0,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.2,
            "impactScore": 1.4,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 2.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 1.2,
            "impactScore": 1.4,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2020-09-17T21:15:17.550",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-74"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "455BCCE5-1D43-4E59-9591-E84B52DAAF0B",
                    "versionEndExcluding": "2.16.11",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B462D769-3FC0-4079-8B48-863F013662EF",
                    "versionEndExcluding": "3.3.2",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
          },
          {
            "lang": "es",
            "value": "En Helm versiones anteriores a 2.16.11 y 3.3.2, se presenta un error en el que el campo \"alias\" en un archivo \"Chart.yaml\" no es saneado  apropiadamente.\u0026#xa0;Esto podr\u00eda conllevar a la inyecci\u00f3n de informaci\u00f3n no deseada en un gr\u00e1fico.\u0026#xa0;Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11.\u0026#xa0;Una posible soluci\u00f3n es revisar manualmente que el campo \"dependencies\" de cualquier gr\u00e1fico no sea de confianza, verificando que el campo \"alias\" no sea usado o (si se utiliza) no contenga nuevas l\u00edneas o caracteres de ruta"
          }
        ],
        "id": "CVE-2020-15184",
        "lastModified": "2024-11-21T05:05:01.673",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 2.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-09-17T21:15:17.550",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-02-23T18:21:45+00:00",
      "cve": "CVE-2020-15184",
      "id": "CVE-2020-15184",
      "initial_release_date": "2020-09-18T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "helm: Chart.yaml is not properly sanitized lead to injection of unwanted information into chart",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-15184.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2025-08-18T02:17:52Z",
      "cve": "CVE-2020-15184",
      "id": "CVE-2020-15184",
      "initial_release_date": "2023-02-15T03:57:01Z",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "33",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-15184",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-15184.json",
      "version": "11"
    }
  }
}

bit-helm-2020-15184

Vulnerability from bitnami_vulndb

Published

2024-03-06 10:55

Modified

2026-09-08 08:34

Summary

Aliases are never checked in Helm

Details

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "helm",
        "purl": "pkg:bitnami/helm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.16.11"
            },
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15184"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*"
    ],
    "severity": "Low"
  },
  "details": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
  "id": "BIT-helm-2020-15184",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T10:55:17.666Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15184"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Aliases are never checked in Helm"
}

CNVD-2020-54304

Vulnerability from cnvd - Published: 2020-09-27

Title

Helm代码问题漏洞

Description

helm是一款Kubernetes包管理器。 Helm 2.16.11 之前版本和3.3.2版本存在安全漏洞，该漏洞源于未能正确清理Chart.yaml的alias字段。目前没有详细漏洞细节提供。

Severity

中

Patch Name

Helm代码问题漏洞的补丁

Patch Description

helm是一款Kubernetes包管理器。 Helm 2.16.11 之前版本和3.3.2版本存在安全漏洞，该漏洞源于未能正确清理Chart.yaml的alias字段。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-15184

Impacted products

Name
['helm helm <2.16.11', 'helm helm 3.3.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-15184",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-15184"
    }
  },
  "description": "helm\u662f\u4e00\u6b3eKubernetes\u5305\u7ba1\u7406\u5668\u3002\n\nHelm 2.16.11 \u4e4b\u524d\u7248\u672c\u548c3.3.2\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u6b63\u786e\u6e05\u7406Chart.yaml\u7684alias\u5b57\u6bb5\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-54304",
  "openTime": "2020-09-27",
  "patchDescription": "helm\u662f\u4e00\u6b3eKubernetes\u5305\u7ba1\u7406\u5668\u3002\r\n\r\nHelm 2.16.11 \u4e4b\u524d\u7248\u672c\u548c3.3.2\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u6b63\u786e\u6e05\u7406Chart.yaml\u7684alias\u5b57\u6bb5\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Helm\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "helm helm \u003c2.16.11",
      "helm helm 3.3.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-15184",
  "serverity": "\u4e2d",
  "submitTime": "2020-09-23",
  "title": "Helm\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2020-15184

Vulnerability from fkie_nvd - Published: 2020-09-17 21:15 - Updated: 2026-06-17 02:56

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776	Third Party Advisory

Impacted products

	Vendor	Product	Version
	helm	helm	*
	helm	helm	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "helm",
          "vendor": "helm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.16.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "455BCCE5-1D43-4E59-9591-E84B52DAAF0B",
              "versionEndExcluding": "2.16.11",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B462D769-3FC0-4079-8B48-863F013662EF",
              "versionEndExcluding": "3.3.2",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
    },
    {
      "lang": "es",
      "value": "En Helm versiones anteriores a 2.16.11 y 3.3.2, se presenta un error en el que el campo \"alias\" en un archivo \"Chart.yaml\" no es saneado  apropiadamente.\u0026#xa0;Esto podr\u00eda conllevar a la inyecci\u00f3n de informaci\u00f3n no deseada en un gr\u00e1fico.\u0026#xa0;Este problema ha sido corregido en Helm versiones 3.3.2 y 2.16.11.\u0026#xa0;Una posible soluci\u00f3n es revisar manualmente que el campo \"dependencies\" de cualquier gr\u00e1fico no sea de confianza, verificando que el campo \"alias\" no sea usado o (si se utiliza) no contenga nuevas l\u00edneas o caracteres de ruta"
    }
  ],
  "id": "CVE-2020-15184",
  "lastModified": "2026-06-17T02:56:13.070",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-17T21:15:17.550",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-9VP5-M38W-J776

Vulnerability from github – Published: 2021-05-24 16:56 – Updated: 2023-10-02 12:24

Summary

Aliases are never checked in helm

Details

Impact

During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart.

Patches

This issue has been patched in Helm 3.3.2 and 2.16.11

Specific Go Packages Affected

helm.sh/helm/v3/pkg/chartutil

Workarounds

Manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "helm.sh/helm/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "helm.sh/helm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.16.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15184"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-24T16:50:04Z",
    "nvd_published_at": "2020-09-17T21:15:00Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nDuring a security audit of Helm\u0027s code base, security researchers at Trail of Bits identified a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart.\n\n### Patches\n\nThis issue has been patched in Helm 3.3.2 and 2.16.11\n\n### Specific Go Packages Affected\nhelm.sh/helm/v3/pkg/chartutil\n\n### Workarounds\n\nManually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
  "id": "GHSA-9vp5-m38w-j776",
  "modified": "2023-10-02T12:24:31Z",
  "published": "2021-05-24T16:56:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/helm/helm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Aliases are never checked in helm"
}

GSD-2020-15184

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-15184

Aliases

CVE-2020-15184

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-15184",
    "description": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
    "id": "GSD-2020-15184",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-15184.html",
      "https://access.redhat.com/errata/RHEA-2021:0729"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-15184"
      ],
      "details": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
      "id": "GSD-2020-15184",
      "modified": "2023-12-13T01:21:43.882731Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-15184",
        "STATE": "PUBLIC",
        "TITLE": "Aliases are never checked in Helm"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "helm",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 2.0.0, \u003c 2.16.11"
                        },
                        {
                          "version_value": "\u003e= 3.0.0, \u003c 3.3.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "helm"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "{\"CWE-20\":\"Improper Input Validation\"}"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
            "refsource": "CONFIRM",
            "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
          },
          {
            "name": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850",
            "refsource": "MISC",
            "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-9vp5-m38w-j776",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.16.11",
          "affected_versions": "All versions before 2.16.11",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2021-11-19",
          "description": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
          "fixed_versions": [
            "2.16.11"
          ],
          "identifier": "CVE-2020-15184",
          "identifiers": [
            "GHSA-9vp5-m38w-j776",
            "CVE-2020-15184"
          ],
          "not_impacted": "All versions starting from 2.16.11",
          "package_slug": "go/helm.sh/helm",
          "pubdate": "2021-05-24",
          "solution": "Upgrade to version 2.16.11 or above.",
          "title": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
          "urls": [
            "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15184",
            "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946",
            "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850",
            "https://github.com/advisories/GHSA-9vp5-m38w-j776"
          ],
          "uuid": "ab3abb97-a274-4ff8-92be-39b2aa8de092"
        },
        {
          "affected_range": "\u003e=3.0.0 \u003c3.3.2",
          "affected_versions": "All versions starting from 3.0.0 before 3.3.2",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2021-11-19",
          "description": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
          "fixed_versions": [
            "3.3.2"
          ],
          "identifier": "CVE-2020-15184",
          "identifiers": [
            "GHSA-9vp5-m38w-j776",
            "CVE-2020-15184"
          ],
          "not_impacted": "All versions before 3.0.0, all versions starting from 3.3.2",
          "package_slug": "go/helm.sh/helm/v3",
          "pubdate": "2021-05-24",
          "solution": "Upgrade to version 3.3.2 or above.",
          "title": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
          "urls": [
            "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15184",
            "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946",
            "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850",
            "https://github.com/advisories/GHSA-9vp5-m38w-j776"
          ],
          "uuid": "2cfedfe3-cb44-4714-b466-bd71b46fd30b"
        },
        {
          "affected_range": "\u003e=2.0.0 \u003c2.16.11||\u003e=3.0.0 \u003c3.3.2",
          "affected_versions": "All versions starting from 2.0.0 before 2.16.11, all versions starting from 3.0.0 before 3.3.2",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2021-11-19",
          "description": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.",
          "fixed_versions": [
            "2.16.11",
            "3.3.2"
          ],
          "identifier": "CVE-2020-15184",
          "identifiers": [
            "GHSA-9vp5-m38w-j776",
            "CVE-2020-15184"
          ],
          "not_impacted": "All versions before 2.0.0, all versions starting from 2.16.11 before 3.0.0, all versions starting from 3.3.2",
          "package_slug": "go/helm.sh/helm/v3/pkg/chartutil",
          "pubdate": "2021-05-24",
          "solution": "Upgrade to versions 2.16.11, 3.3.2 or above.",
          "title": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
          "urls": [
            "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15184",
            "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946",
            "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850",
            "https://github.com/advisories/GHSA-9vp5-m38w-j776"
          ],
          "uuid": "22a3ebc6-e02e-42c1-b3ea-aa1e8216927a"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.16.11",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.3.2",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15184"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-74"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850"
            },
            {
              "name": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2021-11-18T17:50Z",
      "publishedDate": "2020-09-17T21:15Z"
    }
  }
}

RHEA-2021:0729

Vulnerability from csaf_redhat - Published: 2021-03-04 15:08 - Updated: 2026-06-26 22:49

Summary

Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15184.

CVE-2020-15184

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Fixed: 78 products

https://access.redhat.com/errata/RHEA-2021:0729

Open the full advisory

RHEA-2021_0729

Vulnerability from csaf_redhat - Published: 2021-03-04 15:08 - Updated: 2024-11-22 15:58

Summary

Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15184.

CVE-2020-15184

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Fixed: 78 products

https://access.redhat.com/errata/RHEA-2021:0729

Open the full advisory

SUSE-SU-2020:3760-1

Vulnerability from csaf_suse - Published: 2020-12-23 08:18 - Updated: 2026-09-20 13:45

Summary

Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15184.

CVE-2020-15184

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Recommended: 16 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-15184 (GCVE-0-2020-15184)

Vulnerability from bitnami_vulndb

Impact

Patches

Specific Go Packages Affected

Workarounds

Tags

Sightings

Nomenclature

Related by attack behaviour