TI-2020-11957 Aliases CVE-2020-15185 GHSA-jm56-5h66-w453

Duplicated chart entries in Helm

LOW 15CWE-694Published 2020-09-17 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

Why it matters now

EPSS 0.00883 59th percentileScored 2026-11-07

Fix Partial helm (helm): 2.16.11, 3.3.2helm.sh/helm/v3 (Go): 3.3.2+1 more productRed Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
helm	helm	2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2	2.16.11, 3.3.2	Patch available	CNA
—	helm.sh/helm/v3 (Go)	3.0.0 to before 3.3.2	3.3.2	Patch available	GHSA-jm56-5h66-w453
—	helm.sh/helm (Go)	before 2.16.11	2.16.11	Patch available	GHSA-jm56-5h66-w453

helm Vendorhelm Affected 2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2 Fixed in 2.16.11, 3.3.2 Patch available CNA
helm.sh/helm/v3 (Go) Vendor— Affected 3.0.0 to before 3.3.2 Fixed in 3.3.2 Patch available GHSA-jm56-5h66-w453
helm.sh/helm (Go) Vendor— Affected before 2.16.11 Fixed in 2.16.11 Patch available GHSA-jm56-5h66-w453

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:helm:helm::::::::	2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2	Vulnerable	helm

cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2 Vulnerable ·helm

Remediation

Fix · CNA helm (helm) Fixed in 2.16.11, 3.3.2
Fix · GHSA-jm56-5h66-w453 helm.sh/helm/v3 (Go) Fixed in 3.3.2 Advisory →
Fix · GHSA-jm56-5h66-w453 helm.sh/helm (Go) Fixed in 2.16.11 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat OpenStack Platform 16.2

Timeline

2026-10-02 Threatist record created from CVE-2020-15185
2026-10-03 Alias added: GHSA-jm56-5h66-w453

References

Patch 1

https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc

Advisory 2

Other 1

https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946

TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences