GHSA-p5pc-m4q7-7qm9
Helm Unsafe Link Following
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | helm.sh/helm | >= 2.0.0, < 2.15.2 | 2.15.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as `/etc/passwd`, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.
References
External links from the advisory. They lead to third-party sites.