CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1914 vulnerabilities reference this CWE, most recent first.
GHSA-CJJC-XP8V-855W
Vulnerability from github – Published: 2021-06-23 18:02 – Updated: 2024-05-31 17:06The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.
Thanks to @ravin9249 for identifying the vulnerability.
Impact
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.
Patches
A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.
Workarounds
No workaround is available. Users are urged to upgrade.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7919
- https://github.com/helm/helm/pull/8288
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Helm repository
- For security-specific issues, email us at cncf-helm-security@lists.cncf.io
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/helm/helm"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.16.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "helm.sh/helm/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20200124225646-8b5121be2f68"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7919"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-18T22:07:33Z",
"nvd_published_at": "2020-03-16T21:15:00Z",
"severity": "HIGH"
},
"details": "The Helm core maintainers have identified a high severity security vulnerability in Go\u0027s `crypto` package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.\n\nThanks to @ravin9249 for identifying the vulnerability.\n\n### Impact\n\nGo before 1.12.16 and 1.13.x before 1.13.7 (and the `crypto/cryptobyte` package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.\n\n### Patches\n\nA patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.\n\n### Workarounds\n\nNo workaround is available. Users are urged to upgrade.\n\n### References\n\n- https://nvd.nist.gov/vuln/detail/CVE-2020-7919\n- https://github.com/helm/helm/pull/8288\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Helm repository](https://github.com/helm/helm/issues)\n* For security-specific issues, email us at \u003ccncf-helm-security@lists.cncf.io\u003e",
"id": "GHSA-cjjc-xp8v-855w",
"modified": "2024-05-31T17:06:49Z",
"published": "2021-06-23T18:02:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/helm/helm/security/advisories/GHSA-cjjc-xp8v-855w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7919"
},
{
"type": "PACKAGE",
"url": "https://github.com/helm/helm"
},
{
"type": "WEB",
"url": "https://go.dev/cl/216677"
},
{
"type": "WEB",
"url": "https://go.dev/cl/216680"
},
{
"type": "WEB",
"url": "https://go.dev/issue/36837"
},
{
"type": "WEB",
"url": "https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!forum/golang-announce"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/golang-announce/-sdUB4VEQkA"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/golang-announce/Hsw4mHYc470"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/Hsw4mHYc470"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0229"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200327-0001"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4848"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Helm uses crypto package vulnerable to panic from malformed X.509 certificate"
}
GHSA-CJQC-XW23-PP7H
Vulnerability from github – Published: 2022-05-14 03:19 – Updated: 2022-05-14 03:19WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
{
"affected": [],
"aliases": [
"CVE-2013-7201"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-27T16:29:00Z",
"severity": "HIGH"
},
"details": "WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.",
"id": "GHSA-cjqc-xw23-pp7h",
"modified": "2022-05-14T03:19:26Z",
"published": "2022-05-14T03:19:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7201"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92098"
},
{
"type": "WEB",
"url": "https://labs.mwrinfosecurity.com/advisories/paypal-remote-code-execution"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/57351"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJRV-RJ5X-6665
Vulnerability from github – Published: 2022-05-14 03:29 – Updated: 2022-05-14 03:29IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to conduct spoofing attacks via unspecified vectors. IBM X-Force ID: 105200.
{
"affected": [],
"aliases": [
"CVE-2015-4954"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-27T17:29:00Z",
"severity": "MODERATE"
},
"details": "IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to conduct spoofing attacks via unspecified vectors. IBM X-Force ID: 105200.",
"id": "GHSA-cjrv-rj5x-6665",
"modified": "2022-05-14T03:29:52Z",
"published": "2022-05-14T03:29:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4954"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/105200"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21972042"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJRX-G39C-84Q7
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.
{
"affected": [],
"aliases": [
"CVE-2018-15784"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-18T22:29:00Z",
"severity": "HIGH"
},
"details": "Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server\u0027s certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.",
"id": "GHSA-cjrx-g39c-84q7",
"modified": "2022-05-13T01:34:06Z",
"published": "2022-05-13T01:34:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15784"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/article/us/en/04/sln315899/dsa-2019-001-dell-networking-os10-improper-certificate-validation-vulnerability?lang=en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJX9-RGQH-Q7CC
Vulnerability from github – Published: 2022-05-27 00:00 – Updated: 2022-06-09 00:00A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.
{
"affected": [],
"aliases": [
"CVE-2022-26766"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-26T20:15:00Z",
"severity": "MODERATE"
},
"details": "A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.",
"id": "GHSA-cjx9-rgqh-q7cc",
"modified": "2022-06-09T00:00:27Z",
"published": "2022-05-27T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26766"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213253"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213254"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213255"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213256"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213257"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213258"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CM28-J57H-46HG
Vulnerability from github – Published: 2026-05-21 18:33 – Updated: 2026-05-21 18:33Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.
{
"affected": [],
"aliases": [
"CVE-2026-48246"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-21T18:16:21Z",
"severity": "HIGH"
},
"details": "Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.",
"id": "GHSA-cm28-j57h-46hg",
"modified": "2026-05-21T18:33:15Z",
"published": "2026-05-21T18:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48246"
},
{
"type": "WEB",
"url": "https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff"
},
{
"type": "WEB",
"url": "https://github.com/openises/tickets/releases/tag/v3.44.2"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-ajax-reports-php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CM7G-RQQ8-H267
Vulnerability from github – Published: 2022-05-17 02:45 – Updated: 2025-04-20 03:37The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-5918"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-05T07:29:00Z",
"severity": "MODERATE"
},
"details": "The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-cm7g-rqq8-h267",
"modified": "2025-04-20T03:37:14Z",
"published": "2022-05-17T02:45:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5918"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CM7J-P8HC-97VJ
Vulnerability from github – Published: 2022-07-28 00:00 – Updated: 2022-12-12 20:36Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see the plugin documentation.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.11.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:git-client"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-36881"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-322"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-10T17:39:44Z",
"nvd_published_at": "2022-07-27T15:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see [the plugin documentation](https://github.com/jenkinsci/git-client-plugin#ssh-host-key-verification).",
"id": "GHSA-cm7j-p8hc-97vj",
"modified": "2022-12-12T20:36:46Z",
"published": "2022-07-28T00:00:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/git-client-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Git client plugin 3.11.0 does not perform SSH host key verification"
}
GHSA-CM9H-VV4M-6MWP
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2025-04-20 03:39The "Community State Bank - Lamar Mobile Banking" by Community State Bank - Lamar app 3.0.3 -- aka community-state-bank-lamar-mobile-banking/id1083927885 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-9585"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T12:29:00Z",
"severity": "MODERATE"
},
"details": "The \"Community State Bank - Lamar Mobile Banking\" by Community State Bank - Lamar app 3.0.3 -- aka community-state-bank-lamar-mobile-banking/id1083927885 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-cm9h-vv4m-6mwp",
"modified": "2025-04-20T03:39:13Z",
"published": "2022-05-13T01:24:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9585"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPWQ-8448-9QV3
Vulnerability from github – Published: 2026-03-18 21:32 – Updated: 2026-03-18 21:32Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.
{
"affected": [],
"aliases": [
"CVE-2026-4396"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-18T20:16:22Z",
"severity": "HIGH"
},
"details": "Improper certificate validation in Devolutions Hub Reporting Service \n2025.3.1.1 and earlier allows a network attacker to perform a \nman-in-the-middle attack via disabled TLS certificate verification.",
"id": "GHSA-cpwq-8448-9qv3",
"modified": "2026-03-18T21:32:59Z",
"published": "2026-03-18T21:32:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4396"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2026-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.