Subject: [ASA-202102-22] helm: insufficient validation

Arch Linux Security Advisory ASA-202102-22
==========================================

Severity: Low
Date    : 2021-02-07
CVE-ID  : CVE-2021-21303
Package : helm
Type    : insufficient validation
Remote  : No
Link    : https://security.archlinux.org/AVG-1539

Summary
=======

The package helm before version 3.5.2-1 is vulnerable to insufficient
validation.

Resolution
==========

Upgrade to 3.5.2-1.

# pacman -Syu "helm>=3.5.2-1"

The problem has been fixed upstream in version 3.5.2.

Workaround
==========

None.

Description
===========

In Helm from version 3.0 and before version 3.5.2, there are a few
cases where data loaded from potentially untrusted sources was not
properly sanitized. When a SemVer in the `version` field of a chart is
invalid, in some cases Helm allows the string to be used "as is"
without sanitizing. Helm fails to properly sanitize some fields present
in Helm repository `index.yaml` files. Helm does not properly sanitize
some fields in the `plugin.yaml` file for plugins. In some cases, Helm
does not properly sanitize the fields in the `Chart.yaml` file. By
exploiting these attack vectors, core maintainers were able to send
deceptive information to a terminal screen running the `helm` command,
as well as obscure or alter information on the screen. In some cases,
attackers could send codes that terminals used to execute higher-order
logic, like clearing a terminal screen. Further, during evaluation, the
Helm maintainers discovered a few other fields that were not properly
sanitized when read out of repository index files. This fix remedies
all such cases, and once again enforces SemVer2 policies on version
fields. All users of Helm 3 should upgrade to the fixed version 3.5.2
or later. Those who use Helm as a library should verify that they
either sanitize this data on their own, or use the proper Helm API
calls to sanitize the data.

Impact
======

An attacker might be able to spoof the contents of the terminal when
the user runs the "helm" command on a crafted Helm chart that includes
unsanitized terminal input codes.

References
==========

https://github.com/helm/helm/security/advisories/GHSA-c38g-469g-cmgx
https://github.com/helm/helm/commit/2bf5c280d56e0043bf1870f84d63e82d5c5d4230
https://security.archlinux.org/CVE-2021-21303