CVE-2020-11013

{"id": "CVE-2020-11013", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "published": "2020-04-24T20:15:09.793", "references": [{"url": "https://github.com/helm/helm/releases/tag/v3.2.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0"}, {"lang": "es", "value": "Hay una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en Helm desde la versi\u00f3n 3.1.0 y versiones anteriores a la versi\u00f3n 3.2.0. \"lookup\" es una funci\u00f3n de plantilla de Helm introducida en Helm versi\u00f3n v3. Puede buscar recursos en el cl\u00faster para comprobar la existencia de recursos espec\u00edficos y obtener detalles sobre ellos. Esto puede ser usado como parte del proceso para renderizar plantillas. El comportamiento documentado de \"helm template\" afirma que no se adjunta a un cl\u00faster remoto. Sin embargo, la funci\u00f3n de plantilla \"lookup\" agregada recientemente evita esta restricci\u00f3n y se conecta al cl\u00faster a\u00fan durante \"helm template\" y \"helm install|update|delete|rollback --dry-run\". El usuario no es notificado de este comportamiento. Al ejecutar \"helm template\" no deber\u00eda hacer llamadas a un cl\u00faster. Esto es diferente de \"install\", que se supone que tiene acceso a un cl\u00faster para cargar recursos en Kubernetes. Helm versi\u00f3n 2 no est\u00e1 afectado por esta vulnerabilidad. Un autor de gr\u00e1fico malicioso podr\u00eda inyectar una \"lookup\" en un gr\u00e1fico que, cuando es renderizado por medio de \"helm template\", realiza b\u00fasquedas no anunciadas contra el cl\u00faster al que apunta un archivo \"KUBECONFIG\" de user's. Esta informaci\u00f3n puede ser revelada por medio de la salida de \"helm template\". Este problema se ha corregido en Helm 3.2.0"}], "lastModified": "2020-07-06T16:01:24.380", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51D9E69A-2B00-4643-BD5D-74C3EB689213", "versionEndExcluding": "3.2.0", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}