cve.bz

CVE-2020-7919

7.5 highEPSS 2.6%

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE
CWE-295
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cjjc-xp8v-855wGogithub.com/helm/helm>=2.0.0 <2.16.82.16.8
GHSA-cjjc-xp8v-855wGohelm.sh/helm/v3>=3.0.0 <3.1.03.1.0
GHSA-cjjc-xp8v-855wGogolang.org/x/crypto<0.0.0-20200124225646-8b5121be2f680.0.0-20200124225646-8b5121be2f68
GO-2022-0229Gostdlib<1.12.16
>=1.13.0-0 <1.13.7		1.12.16, 1.13.7
GO-2022-0229Gogolang.org/x/crypto<0.0.0-20200124225646-8b5121be2f680.0.0-20200124225646-8b5121be2f68

References

Check your stackJSON