modules:
  - module: helm.sh/helm/v3
    versions:
      - fixed: 3.6.1
    vulnerable_at: 3.6.0
    packages:
      - package: helm.sh/helm/v3/pkg/downloader
        symbols:
          - ChartDownloader.ResolveChartVersion
        derived_symbols:
          - ChartDownloader.DownloadTo
          - Manager.Build
          - Manager.Update
description: |
    The username and password credentials associated with a Helm repository
    can be passed to another domain referenced by that Helm repository.

    If the index.yaml for a Helm repository is hosted on one domain and
    references a chart archive on a different domain, Helm will provide
    the credentials for the index.yaml's domain when fetching those
    archives.
published: 2022-07-15T23:29:45Z
cves:
  - CVE-2021-32690
ghsas:
  - GHSA-56hp-xqp3-w2jf
  - GHSA-7jr6-prv4-5wf5
references:
  - advisory: https://github.com/advisories/GHSA-56hp-xqp3-w2jf
  - fix: https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f