CVE-2019-18658

    Dashboard / Vulnerabilities / CVE-2019-18658

    CVE-2019-18658

    Published: 12 Nov 2019Last Modified: 8 Jul 2026

    Summary:

    Details: In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.

    References: https://helm.sh/blog/2019-10-30-helm-symlink-security-notice/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 51bdad42756dfaf3234f53ef3d3cb6bcd94144c2
    Fixed -8dce272473e5f2a7bf58ce79bb5c3691db54c96b

    Affected versions

    v2.15.1
    v2.15.0
    v2.15.0-rc.2
    v2.15.0-rc.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-18658 | CVE-DB