x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-p5pc-m4q7-7qm9

[GoVulnBot]

In GitHub Security Advisory GHSA-p5pc-m4q7-7qm9, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
helm.sh/helm/v3	2.15.2	>= 2.0.0, < 2.15.2

Cross references:

• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/chartutil: GHSA-9vp5-m38w-j776 #817 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/plugin: GHSA-c52f-pq47-2r9j #820 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/repo: GHSA-jm56-5h66-w453 #851 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/plugin: GHSA-m54r-vrmv-hw33 #856 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-q8q8-93cv-v6h8 #864 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/plugin/installer: GHSA-qq3j-xp49-j73f #868 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-56hp-xqp3-w2jf #384
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in github.com/helm/helm: CVE-2022-36055 #962
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-c38g-469g-cmgx #1040
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-53c4-hhmh-vw5q #1165
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-67fx-wx78-jx33 #1166
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-6rx9-889q-vv2r #1167
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in github.com/helm/helm: CVE-2023-25165 #1547

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: helm.sh/helm/v3
      versions:
        - introduced: 2.0.0
          fixed: 2.15.2
      packages:
        - package: helm.sh/helm/v3
summary: Helm Unsafe Link Following
description: |-
    In Helm 2.x before 2.15.2, commands that deal with loading a chart as a
    directory or packaging a chart provide an opportunity for a maliciously designed
    chart to include sensitive content such as /etc/passwd, or to execute a denial
    of service (DoS) via a special file such as /dev/urandom, via symlinks. No
    version of Tiller is known to be impacted. This is a client-only issue.
cves:
    - CVE-2019-18658
ghsas:
    - GHSA-p5pc-m4q7-7qm9
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-18658
    - web: https://helm.sh/blog/2019-10-30-helm-symlink-security-notice/
    - advisory: https://github.com/advisories/GHSA-p5pc-m4q7-7qm9

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)