Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kubernetes/helm
main @ 188d331
3
Fixes
28
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
internal/plugin: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The plugin installer failed to enforce signature verification when a provenance (.prov) file was completely missing, allowing unsigned and unverified plugins to bypass security controls. Developers should ensure validation logic fails closed when required security metadata is absent.
Path Traversal: The plugin version string from 'plugin.yaml' was previously processed into file paths without semantic validation, enabling attackers to write arbitrary files via directory traversal sequences. Version strings must be strictly parsed using safe semantic versioning rules.
Cryptographic Issues: A silent failure in Digest calculation caused the copier to swallow I/O errors and return empty strings, which undermines the integrity of chart verification mechanisms. Error propagation must be rigorously handled in cryptographic helpers.