Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2021-21303

Vulnerability in helm.sh/helm/v3 (CVE-2021-21303)

Summary

Vulnerability in helm.sh/helm/v3 (CVE-2021-21303). Data can be tampered with by attackers. Exploitable via helm. Mitigation: upgrade to 3.5.2 or later.

Original description

The description as published by the source.

Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted sources was not properly sanitized. When a SemVer in the version field of a chart is invalid, in some cases Helm allows the string to be used "as is" without sanitizing. Helm fails to properly sanitized some fields present on Helm repository index.yaml files. Helm does not properly sanitized some fields in the plugin.yaml file for plugins In some cases, Helm does not properly sanitize the fields in the Chart.yaml file. By exploiting these attack vectors, core maintainers were able to send deceptive information to a terminal screen running the helm command, as well as obscure or alter information on the screen. In some cases, we could send codes that terminals used to execute higher-order logic, like clearing a terminal screen. Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields. All users of the Helm 3 should upgrade to the fixed version 3.5.2 or later. Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sani…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-21303 has been found in helm.sh/helm/v3.
Attackers can target a specific entry point like helm over the network to misuse the product.
Data can be tampered with by attackers.
What to do: upgrade helm.sh/helm/v3 to 3.5.2 or later.
If unsure, ask your IT team or search "helm.sh/helm/v3 CVE-2021-21303" on the vendor's site.

CVE-2021-21303 (helm.sh/helm/v3) — CWE-74
Attack vector: local / no user interaction
Attack surface: helm
Patched: 3.5.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-74) exists in helm.sh/helm/v3. Attackers reach the vulnerable code path via helm.

📍 Affected scope

Check the vendor advisory for the affected versions of helm.sh/helm/v3. Attack surface: helm.

🔥 Severity

Severity: ?. Data can be tampered with by attackers.

🔧 How to fix

Update to 3.5.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'helm.sh/helm/v3' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'helm.sh/helm/v3' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で helm.sh/helm/v3 を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade helm.sh/helm/v3 to 3.5.2

    ステージング環境で 3.5.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Go helm.sh/helm/v3
[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.5.2"}]}]
Bitnami helm
[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.5.2"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details