GO-2022-1040
Insufficient sanitization of data files in helm.sh/helm/v3
At a glance
- Published
- Updated
- CVE
- CVE-2021-21303
- Aliases
- BIT-helm-2021-21303, GHSA-c38g-469g-cmgx
Description
Helm does not sanitize all fields read from repository data files. A maliciously crafted data file may contain strings containing arbitrary data. If printed to a terminal, a malicious string could obscure or alter data on the screen.
Affected packages
| Package | Versions |
|---|---|
| Go · helm.sh/helm/v3 | introduced 3.0.0, fixed 3.5.2 |
References
- https://github.com/advisories/GHSA-c38g-469g-cmgx ADVISORY
- https://github.com/helm/helm/commit/6ce9ba60b73013857e2e7c73d3f86ed70bc1ac9a FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |