Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. helm.sh/helm/v3
  4. ›
  5. CVE-2020-15187

CVE-2020-15187: plugin.yaml file allows for duplicate entries in helm

May 24, 2021 (updated May 29, 2025)

During a security audit of Helm’s code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin’s install hooks, causing a local execution attack.

To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).

References

  • github.com/advisories/GHSA-c52f-pq47-2r9j
  • github.com/helm/helm
  • github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946
  • github.com/helm/helm/commit/ac7c07c37d87e09797f714fb57aa5e9cb99d9450
  • github.com/helm/helm/commit/b0296c0522e837d65f944beefa3fb64fd08ac304
  • github.com/helm/helm/commit/c8d6b01d72c9604e43ee70d0d78fadd54c2d8499
  • github.com/helm/helm/commit/d9ef5ce8bad512e325390c0011be1244b8380e4b
  • github.com/helm/helm/commit/f2ede29480b507b7d8bb152dd8b6b86248b00658
  • github.com/helm/helm/security/advisories/GHSA-c52f-pq47-2r9j
  • nvd.nist.gov/vuln/detail/CVE-2020-15187

Code Behaviors & Features

Detect and mitigate CVE-2020-15187 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 3.0.0 before 3.3.2

Fixed versions

  • 3.3.2

Solution

Upgrade to version 3.3.2 or above.

Impact 4.7 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-694: Use of Multiple Resources with Duplicate Identifier
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Source file

go/helm.sh/helm/v3/CVE-2020-15187.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 30 Aug 2025 12:18:42 +0000.