CVE-2020-15184 - CVE House

Back to Database

Status published Low CVE-2020-15184

Aliases are never checked in Helm

3.7 CVSS

Vulnerability Description

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15184

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from helm

View All →

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Helm May Panic Due To Incorrect YAML Content

Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Affected Vendor

helm

View all reports →

Affected Software

helm

Vulnerable Versions:

>= 2.0.0, < 2.16.11, >= 3.0.0, < 3.3.2

Timeline

Official Publish: September 17th, 2020

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation