{"id":"CVE-2021-32690","published":"2021-06-16T22:10:10Z","modified":"2024-08-03T23:25:31Z","title":"Repository credentials passed to alternate domain","vendor":"helm","product":"helm","tier":"tail","description":{"text":"Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01434,"percentile":0.73058,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/helm/helm/releases/tag/v3.6.1","tags":["x_refsource_MISC"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":14.61},{"name":"CVSS severity","points":4.76}]},"vendorSlug":"helm","affectedVersions":[{"vendor":"helm","product":"helm","versions":["< 3.6.1"]}],"affected":[{"ecosystem":"Go","package":"helm.sh/helm/v3","vulnerableRanges":["<3.6.1"],"patched":["3.6.1"],"from":["GHSA-56hp-xqp3-w2jf","GO-2022-0384"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1265","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-helm-cve-2020-11013","parents":[{"from":"CVE-2021-21303","to":"CVE-2021-32690","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:helm.sh/helm/v3","fromFixed":"3.5.2","toFixed":"3.6.1","daysApart":131},{"kind":"same-code","provenance":"machine","files":["pkg/repo/chartrepo.go"],"commits":["https://github.com/helm/helm/commit/6ce9ba60b73013857e2e7c73d3f86ed70bc1ac9a","https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f"],"basis":"shared function","functions":["DownloadIndexFile"]}]},{"from":"CVE-2020-11013","to":"CVE-2021-32690","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/action/install.go"],"commits":["https://github.com/helm/helm/commit/c67b644a791a8fa61c760a3a0474533e63e74008","https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2021-32690","to":"CVE-2023-25165","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/action/install.go"],"commits":["https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f","https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2","https://github.com/helm/helm/commit/293b50c65d4d56187cd4e2f390f0ada46b4c4737"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-15186","published":"2020-09-17","fixed":"3.3.2","kev":false},{"cve":"CVE-2020-15187","published":"2020-09-17","fixed":"3.3.2","kev":false},{"cve":"CVE-2021-21303","published":"2021-02-05","fixed":"3.5.2","kev":false},{"cve":"CVE-2021-32690","published":"2021-06-16","fixed":"3.6.1","kev":false},{"cve":"CVE-2022-36055","published":"2022-09-01","fixed":"3.9.4","kev":false,"link":{"from":"CVE-2021-32690","to":"CVE-2022-36055","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:helm.sh/helm/v3","fromFixed":"3.6.1","toFixed":"3.9.4","daysApart":442}]}},{"cve":"CVE-2022-23524","published":"2022-12-15","fixed":"3.10.3","kev":false},{"cve":"CVE-2022-23525","published":"2022-12-15","fixed":"3.10.3","kev":false}],"package":"Go:helm.sh/helm/v3"}}