GHSA-cjjc-xp8v-855w

Source

https://github.com/advisories/GHSA-cjjc-xp8v-855w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-cjjc-xp8v-855w/GHSA-cjjc-xp8v-855w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cjjc-xp8v-855w

Aliases

Related

CGA-8g9v-pp84-2m4x

Published

2021-06-23T18:02:39Z

Modified

2024-05-31T17:06:49Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Helm uses crypto package vulnerable to panic from malformed X.509 certificate

Details

The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.

Thanks to @ravin9249 for identifying the vulnerability.

Impact

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.

Patches

A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.

Workarounds

No workaround is available. Users are urged to upgrade.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7919
https://github.com/helm/helm/pull/8288

For more information

If you have any questions or comments about this advisory:

Open an issue in the Helm repository
For security-specific issues, email us at cncf-helm-security@lists.cncf.io

Database specific

{
    "nvd_published_at": "2020-03-16T21:15:00Z",
    "cwe_ids": [
        "CWE-295"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-18T22:07:33Z"
}

References

Affected packages

Go / github.com/helm/helm

Package

Name: github.com/helm/helm; View open source insights on deps.dev
Purl: pkg:golang/github.com/helm/helm

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.16.8

Go / helm.sh/helm/v3

Package

Name: helm.sh/helm/v3; View open source insights on deps.dev
Purl: pkg:golang/helm.sh/helm/v3

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.1.0

Go / golang.org/x/crypto

Package

Name: golang.org/x/crypto; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/crypto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20200124225646-8b5121be2f68