Описание
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a specially crafted Chart to the helm pull --untar command. This would cause the Chart's contents to be written to an unintended directory, potentially overwriting existing files or placing malicious files in an accessible location, leading to data integrity and availability issues.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Engine for Kubernetes | multicluster-engine/addon-manager-rhel9 | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/hypershift-addon-rhel9-operator | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/managedcluster-import-controller-rhel9 | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/multicloud-manager-rhel9 | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/placement-rhel9 | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/registration-operator-rhel9 | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/registration-rhel9 | Under investigation | ||
| Multicluster Engine for Kubernetes | multicluster-engine/work-rhel9 | Under investigation | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-governance-policy-addon-controller-rhel9 | Under investigation | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/multiclusterhub-rhel9 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Helm is a package manager for Charts for Kubernetes. In Helm versions ...
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Уязвимость пакетного менеджера для Kubernetes Helm, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
4.4 Medium
CVSS3