{"id":"CVE-2020-7919","published":"2020-03-16T20:55:31Z","modified":"2024-08-04T09:48:23Z","title":"Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68…","vendor":null,"product":null,"tier":"tail","description":{"text":"Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02647,"percentile":0.85556,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://groups.google.com/forum/#%21forum/golang-announce","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2021/dsa-4848","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20200327-0001/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":17.11}]},"affected":[{"ecosystem":"Go","package":"github.com/helm/helm","vulnerableRanges":[">=2.0.0, <2.16.8"],"patched":["2.16.8"],"from":["GHSA-cjjc-xp8v-855w"],"provenance":"source"},{"ecosystem":"Go","package":"helm.sh/helm/v3","vulnerableRanges":[">=3.0.0, <3.1.0"],"patched":["3.1.0"],"from":["GHSA-cjjc-xp8v-855w"],"provenance":"source"},{"ecosystem":"Go","package":"golang.org/x/crypto","vulnerableRanges":["<0.0.0-20200124225646-8b5121be2f68"],"patched":["0.0.0-20200124225646-8b5121be2f68"],"from":["GHSA-cjjc-xp8v-855w","GO-2022-0229"],"provenance":"source"},{"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.12.16",">=1.13.0-0, <1.13.7"],"patched":["1.12.16","1.13.7"],"from":["GO-2022-0229"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1311","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-3204","published":"2017-04-04","fixed":"0.0.0-20170330155735-e4e2799dd7aa","kev":false},{"cve":"CVE-2019-11840","published":"2019-05-09","fixed":"0.0.0-20190320223903-b7391e95e576","kev":false},{"cve":"CVE-2019-11841","published":"2019-05-22","fixed":"0.0.0-20190424203555-c05e17bb3b2d","kev":false,"link":{"from":"CVE-2019-11841","to":"CVE-2020-7919","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/crypto","fromFixed":"0.0.0-20190424203555-c05e17bb3b2d","toFixed":"0.0.0-20200124225646-8b5121be2f68","daysApart":299}]}},{"cve":"CVE-2020-7919","published":"2020-03-16","fixed":"0.0.0-20200124225646-8b5121be2f68","kev":false},{"cve":"CVE-2020-9283","published":"2020-02-20","fixed":"0.0.0-20200220183623-bac4c82f6975","kev":false},{"cve":"CVE-2020-29652","published":"2020-12-17","fixed":"0.0.0-20201216223049-8b5274cf687f","kev":false},{"cve":"CVE-2021-43565","published":"2022-09-06","fixed":"0.0.0-20211202192323-5770296d904e","kev":false}],"package":"Go:golang.org/x/crypto"}}