CVE-2019-1010275 - CVE House

Back to Database

Status published Critical CVE-2019-1010275

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation....

9.8 CVSS

Vulnerability Description

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-1010275

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from helm

View All →

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Helm May Panic Due To Incorrect YAML Content

Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Affected Vendor

helm

View all reports →

Affected Software

helm

Vulnerable Versions:

Before 2.7.2 [fixed: 2.7.2]

Timeline

Official Publish: July 17th, 2019

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

Credential Access

T1040 Network Sniffing

T1552 Unsecured Credentials

Credential Access

T1071 Application Layer Protocol

Command and Control

T1565 Data Manipulation