Skip to content
Fencer Intel
high 7.5

CVE-2020-7919 json

Helm uses crypto package vulnerable to panic from malformed X.509 certificate

published 6y ago modified last mo. also BIT-golang-2020-7919 , EUVD-2021-1311 , GHSA-cjjc-xp8v-855w , GO-2022-0229

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

Patch / fix

  • go github.com/helm/helm 2.16.8
  • go helm.sh/helm/v3 3.1.0
  • go golang.org/x/crypto 0.0.0-20200124225646-8b5121be2f68
  • bitnami golang 1.12.6, 1.13.7
  • go stdlib 1.12.16, 1.13.7
  • golang go 1.12.6, 1.13.7
  • golang-1.14 Ubuntu 20.04 LTS 1.14~rc1-1

ubuntu advisories UBUNTU-CVE-2020-7919

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.13.7-r0
  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.3.3-r0

alpine advisories ALPINE-CVE-2020-7919

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-7919 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7919 updated cvss 7.5

golang: Integer overflow on 32bit architectures via crafted certificate allows for denial of service

  • Red Hat OpenShift Service Mesh 1 kiali, jaeger, servicemesh, jaeger-operator, servicemesh-cni, servicemesh-mixc, +9 more Red Hat Ceph Storage 2 golang, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +2 more
    +2 more products
    Red Hat OpenShift Virtualization 2 golang Red Hat Storage 3 golang, heketi, grafana, golang-bin, golang-src, golang-misc, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.65% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/helm/helm
>=2.0.0, <2.16.8
2.16.8
go helm.sh/helm/v3
>=3.0.0, <3.1.0
3.1.0
go golang.org/x/crypto
<0.0.0-20200124225646-8b5121be2f68
0.0.0-20200124225646-8b5121be2f68
bitnami golang
>=1.12.0, <1.12.6
>=1.13.0, <1.13.7
1.12.6
1.13.7
go stdlib
<1.12.16
>=1.13.0-0, <1.13.7
1.12.16
1.13.7

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.