Improper Input Validation Affecting github.com/helm/helm/pkg/plugin package, versions <3.5.1


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-GOLANG-GITHUBCOMHELMHELMPKGPLUGIN-1290066
  • published6 May 2021
  • disclosed6 May 2021
  • creditbacongobbler

Introduced: 6 May 2021

CVE NOT AVAILABLE CWE-20  (opens in a new tab)

How to fix?

Upgrade github.com/helm/helm/pkg/plugin to version 3.5.1 or higher.

Overview

github.com/helm/helm/pkg/plugin is a package manager for Kubernetes.

Affected versions of this package are vulnerable to Improper Input Validation. A few cases have been found where data loaded from potentially untrusted sources were not properly sanitized, including invalid SemVer values in the version field of a chart, some fields in Helm repository index.yaml files, some fields in plugin.yaml for plugins, and some fields in the Chart.yaml file.

CVSS Scores

version 3.1