| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| helm.sh/helm | ≥ 2.0.0, < 2.16.11 | 2.16.11 |
| helm.sh/helm/v3 | ≥ 3.0.0, < 3.3.2 | 3.3.2 |
| helm | ≥ 2.0.0, < 2.16.11≥ 3.0.0, < 3.3.2 | 2.16.113.3.2 |
During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack.
To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).
This issue has been patched in Helm 2.16.11 and Helm 3.3.2.
Make sure to install plugins using a secure connection protocol like SSL.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí