Improper Input Validation Affecting helm.sh/helm/v3/pkg/plugin Open this link in a new tab package, versions <3.5.1
Attack Complexity
High
Integrity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-HELMSHHELMV3PKGPLUGIN-1290071
-
published
6 May 2021
-
disclosed
6 May 2021
-
credit
bacongobbler
Introduced: 6 May 2021
CWE-20 Open this link in a new tabHow to fix?
Upgrade helm.sh/helm/v3/pkg/plugin
to version 3.5.1 or higher.
Overview
helm.sh/helm/v3/pkg/plugin is a package manager for Kubernetes.
Affected versions of this package are vulnerable to Improper Input Validation. A few cases have been found where data loaded from potentially untrusted sources were not properly sanitized, including invalid SemVer values in the version
field of a chart, some fields in Helm repository index.yaml
files, some fields in plugin.yaml
for plugins, and some fields in the Chart.yaml
file.