CVE-2024-26147

Summary

CVE-2024-26147 is a vulnerability affecting Helm, the package manager for Kubernetes Charts, prior to version 3.14.2. The issue stems from an uninitialized variable in Helm's handling of index and plugin YAML files with missing metadata. When such files are encountered, a panic occurs, potentially causing Helm client functions to fail. This vulnerability impacts functions related to adding a repository and all Helm functions if a malicious plugin is present. For Helm SDK users, this issue can be mitigated by using the `recover` function to catch panics in affected functions. Helm v3.14.2 addresses this issue and users are advised to upgrade as soon as possible. If a malicious plugin has already been added, it can be removed manually from the filesystem.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.