CVE-2020-7919
Fixed in a distro release EPSS 3%
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Products: golang go, debian_linux, fedoraproject fedora, netapp cloud_insights_telegraf
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/helm/helm | 2.16.8 |
| Go | golang.org/x/crypto | 0.0.0-20200124225646-8b5121be2f68 |
| Go | helm.sh/helm/v3 | 3.1.0 |
| Go | stdlib | 1.12.16 |
| Go | stdlib | 1.13.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dex-k8s-authenticator | 1.4.0-r35 |
| Chainguard | k3d | 5.6.0-r11 |
| Chainguard | k3d-proxy | 5.6.0-r11 |
| Chainguard | k3d-tools | 5.6.0-r11 |
| Debian 10 | golang-1.11 | 1.11.6-1+deb10u4 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | 1.14~rc1-1 |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Wolfi | k3d | 5.6.0-r11 |
| Wolfi | k3d-proxy | 5.6.0-r11 |
| Wolfi | k3d-tools | 5.6.0-r11 |