CVE-2019-1010275
Critical
Description
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.
SeverityCritical
CVSS9.8
Exploit probability—
ProductHelm
PublishedJul 17, 2019
First seenJul 17, 2019
Weakness typeCWE-295CWE-295
How to fix
Update
- helm helm2.7.2 or later
- helm.sh/helm2.7.2, 2.7.2+incompatible or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| helm helm | v < 2.7.2 | 2.7.2 |
| helm.sh/helmGo | v < 2.7.2, v < 2.7.2+incompatible | 2.7.2, 2.7.2+incompatible |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.