Helm uses crypto package vulnerable to panic from malformed X.509 certificate

CVE-2020-7919 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.

Thanks to @ravin9249 for identifying the vulnerability.

Impact

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.

Patches

A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.

Workarounds

No workaround is available. Users are urged to upgrade.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2020-7919
  • https://github.com/helm/helm/pull/8288

For more information

If you have any questions or comments about this advisory:

Basic information

Type
reviewed
Severity
high
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2021-06-23 18:02:39 UTC
Updated
2024-05-31 17:06:49 UTC
GitHub reviewed
2021-06-18 22:07:33 UTC
NVD published
2020-03-16

EPSS Score

Score Percentile
0.65% 70.51%

CVSS Scores

Base score Version Severity Vector
7.5 3.1 —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.

Identifiers

Type Value
GHSA GHSA-cjjc-xp8v-855w ↗
CVE CVE-2020-7919 ↗

CWEs

CWE id Name
CWE-295 Improper Certificate Validation

Affected packages (3)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
go github.com/helm/helm >= 2.0.0, < 2.16.8 2.16.8 —
go golang.org/x/crypto < 0.0.0-20200124225646-8b5121be2f68 0.0.0-20200124225646-8b5121be2f68 —
go helm.sh/helm/v3 >= 3.0.0, < 3.1.0 3.1.0 —

References

cvelogic Threat Intelligence