x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24348

[GoVulnBot]

In CVE-2022-24348, the reference URL github.com/argoproj/argo-cd (and possibly others) refers to something in Go.

module: github.com/argoproj/argo-cd
package: n/a
description: |
    Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
cves:
  - CVE-2022-24348
links:
    context:
      - https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/
      - https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7

See doc/triage.md for instructions on how to triage this report.

[neild]

This appears to be a vulnerability in a binary, not a user-imported package.

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607215 mentions this issue: data/reports: unexclude 20 reports (13)