| Summary: | app-admin/helm: Multiple vulnerabilities (CVE-2020-{4053,11013}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Sam James <sam> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | williamh |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8 | ||
| Whiteboard: | ~4 [cve] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Sam James
2020-04-24 21:18:00 UTC
Please note that Helm 2 is NOT affected, only Helm between version 3.1.0 and before version 3.2.0. @maintainer(s), please create an ebuild for the new 3.2.0 release. Stable version is not affected. Ping :) * CVE-2020-4053 Description: "n Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4." URL: https://github.com/helm/helm/security/advisories/GHSA-qq3j-xp49-j73f The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e709a85f98493abe9b2bcddbcf28b27954f5da30 commit e709a85f98493abe9b2bcddbcf28b27954f5da30 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2020-06-18 02:34:05 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2020-06-18 02:34:05 +0000 app-admin/helm: 3.2.4 bump Bug: https://bugs.gentoo.org/719300 Signed-off-by: William Hubbs <williamh@gentoo.org> app-admin/helm/Manifest | 1 + app-admin/helm/helm-3.2.4.ebuild | 835 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 836 insertions(+) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=71b82897731c0cf483ac7a2d9e4225068adff448 commit 71b82897731c0cf483ac7a2d9e4225068adff448 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2020-06-18 03:05:07 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2020-06-18 03:08:02 +0000 app-admin/helm: remove vulnerable versions Bug: https://bugs.gentoo.org/719300 Signed-off-by: William Hubbs <williamh@gentoo.org> app-admin/helm/Manifest | 306 -------------- app-admin/helm/helm-3.0.3.ebuild | 738 ---------------------------------- app-admin/helm/helm-3.1.2.ebuild | 737 ---------------------------------- app-admin/helm/helm-3.1.3.ebuild | 737 ---------------------------------- app-admin/helm/helm-3.2.0.ebuild | 835 --------------------------------------- 5 files changed, 3353 deletions(-) Cleanup done in 71b82897731c0cf483ac7a2d9e4225068adff448. Thanks! |