GO-2022-0384
Repository credentials passed to alternate domain in helm.sh/helm/v3
At a glance
- Published
- Updated
- CVE
- CVE-2021-32690
- Aliases
- BIT-helm-2021-32690, GHSA-56hp-xqp3-w2jf, GHSA-7jr6-prv4-5wf5
Description
The username and password credentials associated with a Helm repository can be passed to another domain referenced by that Helm repository. If the index.yaml for a Helm repository is hosted on one domain and references a chart archive on a different domain, Helm will provide the credentials for the index.yaml's domain when fetching those archives.
Affected packages
| Package | Versions |
|---|---|
| Go · helm.sh/helm/v3 | introduced 0, fixed 3.6.1 |
References
- https://github.com/advisories/GHSA-56hp-xqp3-w2jf ADVISORY
- https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |