CVE-2020-11013

{"containers": {"cna": {"affected": [{"product": "Helm", "vendor": "helm", "versions": [{"status": "affected", "version": ">= 3.1.0, < 3.2.0"}]}], "descriptions": [{"lang": "en", "value": "Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user&#39;s `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-04-24T20:05:15.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/helm/helm/releases/tag/v3.2.0"}], "source": {"advisory": "GHSA-q8q8-93cv-v6h8", "discovery": "UNKNOWN"}, "title": "lookup Function Information Discolosure in Helm", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-11013", "STATE": "PUBLIC", "TITLE": "lookup Function Information Discolosure in Helm"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Helm", "version": {"version_data": [{"version_value": ">= 3.1.0, < 3.2.0"}]}}]}, "vendor_name": "helm"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user&#39;s `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0"}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}]}, "references": {"reference_data": [{"name": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8", "refsource": "CONFIRM", "url": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8"}, {"name": "https://github.com/helm/helm/releases/tag/v3.2.0", "refsource": "MISC", "url": "https://github.com/helm/helm/releases/tag/v3.2.0"}]}, "source": {"advisory": "GHSA-q8q8-93cv-v6h8", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:21:14.350Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/helm/helm/releases/tag/v3.2.0"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-11013", "datePublished": "2020-04-24T20:05:15.000Z", "dateReserved": "2020-03-30T00:00:00.000Z", "dateUpdated": "2024-08-04T11:21:14.350Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Helm", "vendor": "helm", "versions": [{"status": "affected", "version": ">= 3.1.0, < 3.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*", "matchCriteriaId": "51D9E69A-2B00-4643-BD5D-74C3EB689213", "versionEndExcluding": "3.2.0", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user&#39;s `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0"}, {"lang": "es", "value": "Hay una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en Helm desde la versi\u00f3n 3.1.0 y versiones anteriores a la versi\u00f3n 3.2.0. \"lookup\" es una funci\u00f3n de plantilla de Helm introducida en Helm versi\u00f3n v3. Puede buscar recursos en el cl\u00faster para comprobar la existencia de recursos espec\u00edficos y obtener detalles sobre ellos. Esto puede ser usado como parte del proceso para renderizar plantillas. El comportamiento documentado de \"helm template\" afirma que no se adjunta a un cl\u00faster remoto. Sin embargo, la funci\u00f3n de plantilla \"lookup\" agregada recientemente evita esta restricci\u00f3n y se conecta al cl\u00faster a\u00fan durante \"helm template\" y \"helm install|update|delete|rollback --dry-run\". El usuario no es notificado de este comportamiento. Al ejecutar \"helm template\" no deber\u00eda hacer llamadas a un cl\u00faster. Esto es diferente de \"install\", que se supone que tiene acceso a un cl\u00faster para cargar recursos en Kubernetes. Helm versi\u00f3n 2 no est\u00e1 afectado por esta vulnerabilidad. Un autor de gr\u00e1fico malicioso podr\u00eda inyectar una \"lookup\" en un gr\u00e1fico que, cuando es renderizado por medio de \"helm template\", realiza b\u00fasquedas no anunciadas contra el cl\u00faster al que apunta un archivo \"KUBECONFIG\" de user's. Esta informaci\u00f3n puede ser revelada por medio de la salida de \"helm template\". Este problema se ha corregido en Helm 3.2.0"}], "id": "CVE-2020-11013", "lastModified": "2026-06-17T02:48:51.503", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-24T20:15:09.793", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/helm/helm/releases/tag/v3.2.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/helm/helm/releases/tag/v3.2.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "helm: information discolosure via the lookup function", "id": "1848513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848513"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-200", "details": ["Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user&#39;s `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0", "A flaw was found in helm. The helm template lookup() function bypasses the intended security property that the running `helm template` will not attach to a helm cluster. This flaw allows a malicious template to disclose facts about the cluster without the administrator's consent."], "mitigation": {"lang": "en:us", "value": "Three mitigations are described in the Helm project's advisory.\nRunning `helm lint` will report an error if a template uses the lookup function; thus templates that pass `helm lint` can be used safely without triggering this vulnerability.\nSetting `KUBECONFIG` to point to an empty kubernetes configuration file will prevent unintended network connections.\nManually analysing charts to ensure there is no use of the `lookup` function in the `templates/` directory can prove they are safe to use."}, "name": "CVE-2020-11013", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "osp-director-provisioner-container", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8-tech-preview/osp-director-downloader", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8-tech-preview/osp-director-operator", "product_name": "Red Hat OpenStack Platform 16.2"}], "public_date": "2020-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-11013\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-11013"], "threat_severity": "Low"}

{}