Tóm tắt nhanh
- CVE-2020-15185 là lỗ hổng mức THẤP (CVSS 2.7) ảnh hưởng helm.sh/helm, helm.sh/helm/v3, helm (helm).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.88%, cao hơn 59.2% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.16.11, 3.3.2 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| helm.sh/helm Go | < 2.16.11
| 2.16.11
|
| helm.sh/helm/v3 Go | ≥ 3.0.0, < 3.3.2
| 3.3.2
|
| helm | ≥ 2.0.0, < 2.16.11≥ 3.0.0, < 3.3.2
| 2.16.113.3.2
|
Mô tả
Impact
During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.
To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).
Specific Go Packages Affected
helm.sh/helm/v3/pkg/repo
Patches
This issue has been patched in Helm 3.3.2 and 2.16.11
Workarounds
- do not install charts from repositories you do not trust
- fetch charts using a secure channel of communication (such as TLS)
- use
helm pull to fetch the chart, then review the chart’s content (either manually, or with helm verify if it has been signed) to ensure it has not been tampered with
- manually review the index file in the Helm repository cache before installing software.
Mô tả của NVD
In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí