Improper Input Validation Affecting github.com/helm/helm/pkg/plugin package, versions <3.5.1


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-GOLANG-GITHUBCOMHELMHELMPKGPLUGIN-1290066
  • published 6 May 2021
  • disclosed 6 May 2021
  • credit bacongobbler

Introduced: 6 May 2021

CVE NOT AVAILABLE CWE-20 Open this link in a new tab

How to fix?

Upgrade github.com/helm/helm/pkg/plugin to version 3.5.1 or higher.

Overview

github.com/helm/helm/pkg/plugin is a package manager for Kubernetes.

Affected versions of this package are vulnerable to Improper Input Validation. A few cases have been found where data loaded from potentially untrusted sources were not properly sanitized, including invalid SemVer values in the version field of a chart, some fields in Helm repository index.yaml files, some fields in plugin.yaml for plugins, and some fields in the Chart.yaml file.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
5.9 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    High
  • Availability (A)
    None