Description: "A malicious chart author could inject a lookup into a chart that, when rendered through helm template, performs unannounced lookups against the cluster a user's KUBECONFIG file points to. This information can then be disclosed via the output of helm template."
Please note that Helm 2 is NOT affected, only Helm between version 3.1.0 and before version 3.2.0. @maintainer(s), please create an ebuild for the new 3.2.0 release. Stable version is not affected.
Ping :)
* CVE-2020-4053 Description: "n Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4." URL: https://github.com/helm/helm/security/advisories/GHSA-qq3j-xp49-j73f
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e709a85f98493abe9b2bcddbcf28b27954f5da30 commit e709a85f98493abe9b2bcddbcf28b27954f5da30 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2020-06-18 02:34:05 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2020-06-18 02:34:05 +0000 app-admin/helm: 3.2.4 bump Bug: https://bugs.gentoo.org/719300 Signed-off-by: William Hubbs <williamh@gentoo.org> app-admin/helm/Manifest | 1 + app-admin/helm/helm-3.2.4.ebuild | 835 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 836 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=71b82897731c0cf483ac7a2d9e4225068adff448 commit 71b82897731c0cf483ac7a2d9e4225068adff448 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2020-06-18 03:05:07 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2020-06-18 03:08:02 +0000 app-admin/helm: remove vulnerable versions Bug: https://bugs.gentoo.org/719300 Signed-off-by: William Hubbs <williamh@gentoo.org> app-admin/helm/Manifest | 306 -------------- app-admin/helm/helm-3.0.3.ebuild | 738 ---------------------------------- app-admin/helm/helm-3.1.2.ebuild | 737 ---------------------------------- app-admin/helm/helm-3.1.3.ebuild | 737 ---------------------------------- app-admin/helm/helm-3.2.0.ebuild | 835 --------------------------------------- 5 files changed, 3353 deletions(-)
Cleanup done in 71b82897731c0cf483ac7a2d9e4225068adff448. Thanks!
