CVE-2020-7919
HighAdvisory
Published 23 Jun 2021In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.026
- 85th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 153
- of 17,781 indexed, latest versions
- Container images
- 130
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Carried by container images the latest versions of 153 of 17,781 indexed charts deploy, on 130 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| golang.org/ | v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+27 more | 0.0.0-20200124225646-8b5121be2f68 | 107 |
| helm.sh/ | v3.0.2, v3.0.3 | 3.1.0 | 3 |
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+2 more | 1.12.16 | 54 |
- OSV records
- GHSA-cjjc-xp8v-855wGO-2022-0229
- Also known as
- BIT-golang-2020-7919
Charts affected
153 by stars
Container images carrying it
130 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 24a5204b418e | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 6 |
| prom/ | 7e4e9f7a0954 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 5 |
| prom/ | 0a8caa2e9f19 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 5 |
| quay.io/ | e6df72478956 | stdlib | 1.12.16 | 5 |
| grafana/ | 1ff3999e0fc0 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 4 |
| argoproj/ | 830e86cacefd | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 3 |
| mintel/ | caf71cee7b9a | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 3 |
| stakater/ | 83fef483d497 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 3 |
| quay.io/ | 7bcf286807b8 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 3 |
| quay.io/ | f402e6039b3c | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 3 |
| registry.k8s.io/ | c825f3d5e28b | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 3 |
| cesanta/ | 4d16885f3d4c | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| csiplugin/ | 0766163dc046 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| grafana/ | 922b3f412fdd | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| grafana/ | 46e88d390cd6 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| iomesh/ | f4878c8ae53a | stdlib | 1.12.16 | 2 |
| jettech/ | c42098c8d855 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| osixia/ | ccd95cc6e61e | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 2 |
| prom/ | 1ffc3f109eb3 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| prom/ | 42d2395cd719 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| prom/ | a5df60347882 | stdlib | 1.12.16 | 2 |
| squareup/ | 70f4cf270425 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 2 |
| thomasnyambati/ | 148ae3f99fea | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| weblate/ | 69c160d37a3c | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 2 |
| gcr.io/ | 2de1d15fc1f2 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| quay.io/ | c9b7f6d0d953 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 2 |
| alpine/ | a41efe02a041 | stdlib | 1.12.16 | 1 |
| amazon/ | b55277652ea8 | stdlib | 1.12.16 | 1 |
| ansgroup/ | cd6b0ef2b309 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| apache/ | 641237e0299b | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| apache/ | 67d50e4deff4 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| assistiot/ | 9bb46ea14e8e | stdlib | 1.12.16 | 1 |
| bitnamilegacy/ | e3c9d6b4bc92 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| cfcontainerization/ | 82fa261c18a8 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| cfcontainerization/ | 58fb1c173a46 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| chandanteekinavar/ | c96f759b6ce4 | stdlib | 1.12.16 | 1 |
| cloudposse/ | 0d9507e8a760 | stdlib | 1.12.16 | 1 |
| codercom/ | 47605610ad8d | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| crowdfox/ | 6fa7e8063d27 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| dasmeta/ | fa657960dfec | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| datappeal/ | e38c085a3567 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| datawire/ | f95ae710d75c | golang.org/ helm.sh/ | 0.0.0-20200124225646-8b5121be2f68 3.1.0 | 1 |
| devspacecloud/ | 49c397413f7b | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| drone/ | 137e79c5e23c | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| drone/ | 206df2280ecf | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| engrmth/ | 6d8464e6f0e8 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| envoyproxy/ | 71081616da3e | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| gitlab/ | fd7e5dfb9f30 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |
| gomods/ | d714c7ff0231 | golang.org/ stdlib | 0.0.0-20200124225646-8b5121be2f68 1.12.16 | 1 |
| gomods/ | efb811df7844 | golang.org/ | 0.0.0-20200124225646-8b5121be2f68 | 1 |