Skip to content
OpenAdvisories
Medium · 6.8 CVE-2021-32690 BIT-helm-2021-32690EUVD-2021-1265GHSA-56hp-xqp3-w2jfGHSA-7jr6-prv4-5wf5GO-2022-0384

Repository credentials passed to alternate domain

Published Jun 16, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Description

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.

Affected products

VendorProductAffectedFixed
helm helm < 3.6.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Alpine v3.24 helm 3.6.1-r0 —
Alpine v3.23 helm 3.6.1-r0 —
Alpine v3.22 helm 3.6.1-r0 —
Alpine v3.21 helm 3.6.1-r0 —
Alpine v3.20 helm 3.6.1-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 helm 3.6.1-r0 —
Alpine v3.18 helm 3.6.1-r0 —
Alpine v3.17 helm 3.6.1-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) helm 3.4.1-4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go helm.sh/helm/v3 < 3.6.1 3.6.1 GHSA-56hp-xqp3-w2jf

Advisories 1

References