CVE-2019-1010275: Improper Certificate Validation

May 24, 2022 (updated August 1, 2023)

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.

References

github.com/advisories/GHSA-x6r5-vxfg-gq3v
github.com/helm/helm/commit/1096813bf9a425e2aa4ac755b6c991b626dfab50
github.com/helm/helm/pull/3152
github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50
github.com/helm/helm/releases/tag/v2.7.2
nvd.nist.gov/vuln/detail/CVE-2019-1010275

Code Behaviors & Features

Detect and mitigate CVE-2019-1010275 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →