x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-xrxm-mvqm-r553

[GoVulnBot]

In GitHub Security Advisory GHSA-xrxm-mvqm-r553, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
helm.sh/helm/v3	2.12.2	>= 2.0.0, < 2.12.2

Cross references:

• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/chartutil: GHSA-9vp5-m38w-j776 #817 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/plugin: GHSA-c52f-pq47-2r9j #820 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/repo: GHSA-jm56-5h66-w453 #851 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/plugin: GHSA-m54r-vrmv-hw33 #856 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-q8q8-93cv-v6h8 #864 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3/pkg/plugin/installer: GHSA-qq3j-xp49-j73f #868 NOT_IMPORTABLE
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-56hp-xqp3-w2jf #384
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in github.com/helm/helm: CVE-2022-36055 #962
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-c38g-469g-cmgx #1040
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-53c4-hhmh-vw5q #1165
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-67fx-wx78-jx33 #1166
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-6rx9-889q-vv2r #1167
• Module helm.sh/helm/v3 appears in issue x/vulndb: potential Go vuln in github.com/helm/helm: CVE-2023-25165 #1547

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: helm.sh/helm/v3
      versions:
        - introduced: 2.0.0
          fixed: 2.12.2
      packages:
        - package: helm.sh/helm/v3
summary: Helm Path Traversal
description: |-
    All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22:
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that
    can result when chart archive files are unpacked a file may be unpacked outside
    of the target directory. This attack appears to be exploitable via a victim must
    run a helm command on a specially crafted chart archive. This vulnerability
    appears to have been fixed in 2.12.2.
cves:
    - CVE-2019-1000008
ghsas:
    - GHSA-xrxm-mvqm-r553
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-1000008
    - web: https://helm.sh/blog/helm-security-notice-2019/index.html
    - advisory: https://github.com/advisories/GHSA-xrxm-mvqm-r553

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)