search

sonatype-nexus-community / nexus-repository-helm

At the Helm, Helm Yeah, v k8s
Eclipse Public License 1.0
97 stars 71 forks source link

NEXUS-24501: RCE in Helm #151

Closed proteus1121 closed 4 years ago

proteus1121 commented 4 years ago

ticket: https://issues.sonatype.org/browse/NEXUS-24501

more details about this issue: https://securitylab.github.com/research/swagger-yaml-parser-vulnerability

proteus1121 commented 4 years ago

@thejosh00 Good point, also changed in IndexYamlAbsoluteUrlRewriter https://github.com/sonatype-nexus-community/nexus-repository-helm/pull/151/commits/a251b64bb1713e7e5a5adbe7a25cc007d7a6814a