In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.
References
Link | Resource |
---|---|
https://helm.sh/blog/2019-10-30-helm-symlink-security-notice/ | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-11-12T13:20:13
Updated: 2019-11-12T13:20:13
Reserved: 2019-10-31T00:00:00
Link: CVE-2019-18658
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-11-12T14:15:11.343
Modified: 2019-11-14T14:40:14.683
Link: CVE-2019-18658
JSON object: View
Redhat Information
No data.
CWE