In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with
    the last one always used. If a plugin is compromised, this lowers the level of access that an attacker
    needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an
    attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded
    (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm
    2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection
    protocol like SSL. (CVE-2020-15187)

= Required Actions

== Kubernetes & etcd (Security fixes)

This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_updating_kubernetes_components for the upgrade procedure.

== Skuba & helm/helm3

In order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_update_management_workstation

= Known Issues

Modifying the file `/etc/sysconfig/kubelet` directly is not supported:
documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscel laneo us.html#_configuring_kubelet

Be sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2
_4 for any additional known issues or behavioral changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
431931	SCA: security update for helm.sh/helm, helm.sh/helm/v3 (GHSA-c52f-pq47-2r9j)	Tenable Cloud Security	SCA Checks	Local	medium
431931	SCA: security update for helm.sh/helm, helm.sh/helm/v3 (GHSA-c52f-pq47-2r9j)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
144173	SUSE SLES15 Security Update : Security changes in Kubernetes, etcd, / helm; Bugfix in cri-o package (SUSE-SU-2020:3760-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-15187

medium

Tenable Plugins

medium

medium

medium