PT-2019-11539 · Kubernetes · Helm

Technosophos · Published 2019-07-17 · Updated 2024-08-20 · CVE-2019-1010275

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: helm versions prior to 2.7.2

Description: The issue concerns improper certificate validation, allowing unauthorized clients to connect to the server because self-signed client certificates were allowed. A malicious client could exploit this by connecting to the server over the network.

Recommendations: For versions prior to 2.7.2, update to version 2.7.2 to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation by unauthorized clients.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-1010275

GHSA-X6R5-VXFG-GQ3V

GO-2023-1993

Affected Products

Helm

References · 12

• https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50 · Patch
• https://github.com/helm/helm/pull/3152 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010275 · Security Note
• https://osv.dev/vulnerability/GO-2023-1993 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x6r5-vxfg-gq3v · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010275 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010275 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-1010275 · Security Note
• https://github.com/helm/helm/releases/tag/v2.7.2 · Note
• https://github.com/helm/helm/commit/1096813bf9a425e2aa4ac755b6c991b626dfab50 · Note
• https://github.com/advisories/GHSA-x6r5-vxfg-gq3v · Note