CVE-2020-15185 Duplicated chart entries in Helm

What is CVE-2020-15185?

CVE-2020-15185 is a low-severity vulnerability in helm, published on 17 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.

Weakness: CWE-74, CWE-694

Which versions are affected by CVE-2020-15185?

5 open source packages ship an affected version, including helm.sh/helm, helm and helm.sh/helm/v3. It affects 1 product.

Products include Helm Helm.

How do I fix CVE-2020-15185?

Upgrade helm.sh/helm to 2.16.11 or later.

Is CVE-2020-15185 being exploited?

There is no known exploitation of CVE-2020-15185 in the wild and no public exploit code.

Other vulnerabilities in helm

• CVE-2019-18658 Helm Unsafe Link Following Critical 9.8
• CVE-2019-1010275 Helm Improper Certificate Validation Critical 9.8
• CVE-2019-25210 Information disclosure in n/a Critical 9.1
• CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution High 8.5
• CVE-2020-11013 lookup Function Information Discolosure in Helm High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-helm-2020-15185, GHSA-jm56-5h66-w453.