Helm up to 3.14.1 uninitialized variable

Summaryinfo

A vulnerability categorized as problematic has been discovered in Helm up to 3.14.1. This issue affects some unknown processing. Executing a manipulation can lead to uninitialized variable. This vulnerability is registered as CVE-2024-26147. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Helm up to 3.14.1. It has been declared as problematic. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a uninitialized variable vulnerability. The CWE definition for the vulnerability is CWE-457. The code uses a variable that has not been initialized, leading to unpredictable or unintended results. As an impact it is known to affect availability. CVE summarizes:

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use `recover` to catch the panic.

The weakness was published 02/22/2024 as GHSA-r53h-jv2g-vpx6. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-26147 since 02/14/2024. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 212280 (SUSE SLES15 / openSUSE 15 : Recommended update for helm (SUSE-SU-SUSE-RU-2024:4213-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.14.2 eliminates this vulnerability. Applying the patch bb4cc9125503a923afb7988f3eb478722a8580af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (212280). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Helm

Version

• 3.14.0
• 3.14.1

License

• open-source

Website

• Product: https://github.com/helm/helm/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion