QID 982059

QID 982059: Go (go) Security Update for github.com/helm/helm (GHSA-c38g-469g-cmgx)


Since Helm 2 was released, a well-documented aspect of Helm is that the Helm chart's version number MUST follow the SemVer2 specification. In the past, Helm would not permit charts with malformed versions. At some point, a patch was merged that changed this - On a version parse error, the version number was simply passed along as-is. This provided a vector for malicious data to be injected into Helm and potentially used in various ways.

Core maintainers were able to send deceptive information to a terminal screen running the `helm` command, as well as obscure or alter information on the screen. In some cases, we could send codes that terminals used to execute higher-order logic, like clearing a terminal screen.

Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields.

All users of the Helm 3 should upgrade.

Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

  • CVSS V3 rated as Medium - 5.9 severity.
  • CVSS V2 rated as Medium - 4 severity.
    • Solution
    This issue has been resolved in Helm 3.5.1.

    While this fix does not constitute a breaking change, as all field formatting is now enforced as documented, it is possible that charts that were mistakenly allowed (but invalid) may no longer be available in search indexes. Specifically, **malformed SemVer versions are no longer supported**. This has always been the documented case, but it is true that malformed versions were allowed.

    Note that this is the first security release since Helm 2's final deprecation. Helm 2 was not audited for vulnerability to this issue, and should be assumed vulnerable.
    Vendor References

    CVEs related to QID 982059

    CVE-2021-21303 |
    Software Advisories
    Advisory ID Software Component Link
    GHSA-c38g-469g-cmgx github.com/helm/helm URL Logo github.com/advisories/GHSA-c38g-469g-cmgx
    GHSA-c38g-469g-cmgx helm.sh/helm/v3 URL Logo github.com/advisories/GHSA-c38g-469g-cmgx
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].