CVE-2020-7919
HighAdvisory
Published 23 Jun 2021In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.026
- 85th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 153
- of 17,781 indexed, latest versions
- Container images
- 130
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Carried by container images the latest versions of 153 of 17,781 indexed charts deploy, on 130 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| golang.org/ | v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+27 more | 0.0.0-20200124225646-8b5121be2f68 | 107 |
| helm.sh/ | v3.0.2, v3.0.3 | 3.1.0 | 3 |
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+2 more | 1.12.16 | 54 |
- OSV records
- GHSA-cjjc-xp8v-855wGO-2022-0229
- Also known as
- BIT-golang-2020-7919
Charts affected
153 by stars
Container images carrying it
130 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| thomseddon/ | e875194d67e2 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| timescale/ | ed719c0cd19d | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| timescale/ | 7758704d4a14 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| timonwong/ | a0fcc028bd8d | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| tobiasbp/ | 14bee6e33a26 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| traggo/ | f1ced637510e | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| ubercadence/ | 2ac5491d13bb | stdlib | 1.12.16 | 1 |
| volantmq/ | 9bfe7857ebc3 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| weaveworks/ | a9c2e9df4227 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| weaveworks/ | 3cdac6928a63 | stdlib | 1.12.16 | 1 |
| weblate/ | 82848df56ecd | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| wener/ | cc9fd4da44c0 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| wener/ | 5c92cc9e8597 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| xingse/ | 9f9d5492e4bf | stdlib | 1.12.16 | 1 |
| gcr.io/ | a85176b8e7cc | stdlib | 1.12.16 | 1 |
| gcr.io/ | 2b1a3d08caac | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| gcr.io/ | a348db3e4d74 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| ghcr.io/ | 087618d16b83 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| ghcr.io/ | e949b0f733f0 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| mcr.microsoft.com/ | f55f30876129 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| mcr.microsoft.com/ | 667b1b1ea1e4 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| public.ecr.aws/ | cac3ed9a9826 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| quay.io/ | d6fd2a9e3273 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| quay.io/ | fe2e2e5a2751 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| quay.io/ | 9663f06adcb1 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| quay.io/ | 791aef35b8d1 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| quay.io/ | c6a934439421 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| quay.io/ | 21e6d6a155dc | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| registry.gitlab.com/ | e0ab1fc86761 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| registry.gitlab.com/ | cf72810d33f5 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |