A vulnerability was found in Helm up to 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown code of the component Certificate Validation Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.

The weakness was disclosed 07/17/2019. This vulnerability is known as CVE-2019-1010275 since 03/20/2019. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

Upgrading to version 2.7.2 eliminates this vulnerability.

The entries VDB-147256, VDB-154879, VDB-157186 and VDB-161136 are pretty similar.

Productinfo

Name

• Helm

Version

• 2.7.0
• 2.7.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion