CVE-2024-26147
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-26147 is a vulnerability affecting versions prior to 3.14.2 of Helm, a package manager for Kubernetes Charts. This issue arises when Helm encounters missing metadata in index and plugin YAML files, leading to an uninitialized variable panic. For Helm SDK users, this vulnerability can be triggered when using the `LoadIndexFile`, `DownloadIndexFile`, or `LoadDir` functions. For Helm clients, all functions may be impacted if a malicious plugin is added. This issue has been resolved in Helm v3.14.2. To mitigate the risk of a panic causing disruption, Helm SDK users can employ `recover` when calling affected functions. Users should also manually remove any malicious plugins from their filesystem.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.