Vulnerability · Published Jun 16, 2021 · Assigned by GitHub_M
CVE-2021-32690Repository credentials passed to alternate domain
Medium 6.8
In plain English
A medium-severity information exposure in helm from helm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | helm | 3.6.1-r0 | ALPINE-CVE-2021-32690 |
| Alpine:v3.21 | helm | 3.6.1-r0 | ALPINE-CVE-2021-32690 |
| Alpine:v3.22 | helm | 3.6.1-r0 | ALPINE-CVE-2021-32690 |
| Alpine:v3.23 | helm | 3.6.1-r0 | ALPINE-CVE-2021-32690 |
| Alpine:v3.24 | helm | 3.6.1-r0 | ALPINE-CVE-2021-32690 |
| Go | helm.sh/helm/v3 | 3.6.1 | GHSA-56hp-xqp3-w2jf |
| Go | helm.sh/helm/v3 | 3.6.1 | GHSA-7jr6-prv4-5wf5 |
| Go | helm.sh/helm/v3 | 3.6.1 | GO-2022-0384 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf x_refsource_CONFIRM
- https://github.com/helm/helm/releases/tag/v3.6.1 x_refsource_MISC