CVE-2021-32690: Repository credentials passed to alternate domain
First published: Wed Jun 16 2021(Updated: )
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-56hp-xqp3-w2jf. This link is maintained to preserve external references. ## Original Description Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/helm.sh/helm/v3 | <3.6.1 | 3.6.1 |
| Helm Helm | <3.6.1 | |
| redhat/helm | <3.6.1 | 3.6.1 |
| <3.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf
- https://nvd.nist.gov/vuln/detail/CVE-2021-32690
- https://github.com/helm/helm/releases/tag/v3.6.1
- https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f
- https://pkg.go.dev/vuln/GO-2022-0384
- https://github.com/advisories/GHSA-56hp-xqp3-w2jf (Advisory)
- https://github.com/advisories/GHSA-7jr6-prv4-5wf5 (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/203901
- https://www.ibm.com/support/pages/node/6843071 (Advisory)
- https://github.com/helm/helm/commit/179f90151d5ecb4aa3d35ada35e82b5c1e791752
- https://access.redhat.com/errata/RHSA-2021:3759
- https://access.redhat.com/security/cve/cve-2021-32690
- https://access.redhat.com/errata/RHSA-2021:3925
- https://access.redhat.com/errata/RHSA-2021:4618
- https://access.redhat.com/errata/RHSA-2021:4902
- https://bugzilla.redhat.com/show_bug.cgi?id=1978144
- https://www.cve.org/CVERecord?id=CVE-2021-32690 https://nvd.nist.gov/vuln/detail/CVE-2021-32690 https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-32690?
CVE-2021-32690 is a vulnerability in Helm that allows credentials associated with a Helm repository to be passed on to another domain referenced by that repository.
What is the severity of CVE-2021-32690?
CVE-2021-32690 has a severity rating of high (8.6).
What software versions are affected by CVE-2021-32690?
Versions of Helm prior to 3.6.1 are affected by CVE-2021-32690.
How can I fix CVE-2021-32690?
To fix CVE-2021-32690, upgrade to Helm version 3.6.1 or later.
Where can I find more information about CVE-2021-32690?
You can find more information about CVE-2021-32690 at the following references: [GitHub Advisory](https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-32690), [Helm Releases](https://github.com/helm/helm/releases/tag/v3.6.1).
- collector/redhat-cve
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-32690
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-56hp-xqp3-w2jf
- alias/GHSA-7jr6-prv4-5wf5
- agent/description
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/helm
- canonical/helm helm
- package-manager/redhat
- package-manager/go