{"id":"CVE-2020-15184","published":"2020-09-17T20:40:12Z","modified":"2024-08-04T13:08:22Z","title":"Aliases are never checked in Helm","vendor":"helm","product":"helm","tier":"tail","description":{"text":"In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01029,"percentile":0.63556,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850","tags":["x_refsource_MISC"]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":12.71},{"name":"CVSS severity","points":2.59}]},"vendorSlug":"helm","affectedVersions":[{"vendor":"helm","product":"helm","versions":[">= 2.0.0, < 2.16.11",">= 3.0.0, < 3.3.2"]}],"affected":[{"ecosystem":"Go","package":"helm.sh/helm/v3","vulnerableRanges":[">=3.0.0, <3.3.2"],"patched":["3.3.2"],"from":["GHSA-9vp5-m38w-j776"],"provenance":"source"},{"ecosystem":"Go","package":"helm.sh/helm","vulnerableRanges":["<2.16.11"],"patched":["2.16.11"],"from":["GHSA-9vp5-m38w-j776"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1031","exploited":false,"provenance":"source"}}