PT-2019-11539 · Kubernetes · Helm

Technosophos · Publicado 2019-07-17 · Atualizado 2024-08-20 · CVE-2019-1010275

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: helm versions prior to 2.7.2

Description: The issue concerns improper certificate validation, allowing unauthorized clients to connect to the server because self-signed client certificates were allowed. A malicious client could exploit this by connecting to the server over the network.

Recommendations: For versions prior to 2.7.2, update to version 2.7.2 to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation by unauthorized clients.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-1010275

GHSA-X6R5-VXFG-GQ3V

GO-2023-1993

Produtos afetados

Helm

Referências · 12

• https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50 · Correção
• https://github.com/helm/helm/releases/tag/v2.7.2 · Nota
• https://github.com/helm/helm/pull/3152 · Correção
• https://github.com/helm/helm/commit/1096813bf9a425e2aa4ac755b6c991b626dfab50 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010275 · Nota de Segurança
• https://github.com/advisories/GHSA-x6r5-vxfg-gq3v · Nota
• https://osv.dev/vulnerability/GO-2023-1993 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x6r5-vxfg-gq3v · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-1010275 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010275 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1010275 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-1010275 · Nota de Segurança