Most recent entries from all

BIT-helm-2020-15184 — Aliases are never checked in Helm

Affected: Bitnami: helm

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

cnvd-2020-54304

EUVD-2026-42721

fkie_cve-2020-15184

GHSA-9vp5-m38w-j776 — Aliases are never checked in helm

Affected: Go: helm.sh/helm/v3, Go: helm.sh/helm

### Impact

During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart.

### Patches

This issue has been patched in Helm 3.3.2 and 2.16.11

### Specific Go Packages Affected helm.sh/helm/v3/pkg/chartutil

### Workarounds

Manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

gsd-2020-15184

RHEA-2021:0729 — Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images

golang-github-buger-jsonparser: infinite loop via a Delete call node-fetch: size of data after fetch() JS thread leads to DoS helm: Chart.yaml is not properly sanitized lead to injection of unwanted information into chart helm: write access to the index file allows an attacker to inject bad chart into repository helm: plugin names are not sanitized properly helm: write access to the git repository or plugin archive causing causing a local execution attack jsonparser: GET call can lead to a slice bounds out of range redisgraph: NULL pointer dereference because it mishandles an unquoted string

SUSE-SU-2020:3760-1 — Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package

Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package