| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/helm/helm | ≥ 2.0.0, < 2.16.8 | 2.16.8 |
| golang.org/x/crypto | < 0.0.0-20200124225646-8b5121be2f68 | 0.0.0-20200124225646-8b5121be2f68 |
| helm.sh/helm/v3 | ≥ 3.0.0, < 3.1.0 | 3.1.0 |
| stdlib | ≥ 1.13.0-0, < 1.13.7< 1.12.16 | 1.13.71.12.16 |
| go | ≥ 1.12, < 1.12.6≥ 1.13, < 1.13.7 | 1.12.61.13.7 |
The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.
Thanks to @ravin9249 for identifying the vulnerability.
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.
A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.
No workaround is available. Users are urged to upgrade.
If you have any questions or comments about this advisory:
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン