data/reports: add GO-2024-2554.yaml

Aliases: CVE-2024-25620, GHSA-v53g-5gjp-272r

Fixes #2554

Change-Id: I9ee1f5ffb3a00fb20048601eb06cc40718dbb80f
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/568035
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>

data/osv/GO-2024-2554.json

@@ -0,0 +1,76 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2554",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-25620",
+    "GHSA-v53g-5gjp-272r"
+  ],
+  "summary": "Path traversal in helm.sh/helm/v3",
+  "details": "Path traversal in helm.sh/helm/v3",
+  "affected": [
+    {
+      "package": {
+        "name": "helm.sh/helm/v3",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.14.1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "helm.sh/helm/v3/pkg/chart",
+            "symbols": [
+              "Chart.Validate",
+              "Metadata.Validate"
+            ]
+          },
+          {
+            "path": "helm.sh/helm/v3/pkg/chartutil",
+            "symbols": [
+              "CreateFrom",
+              "Save",
+              "SaveDir",
+              "writeTarContents"
+            ]
+          },
+          {
+            "path": "helm.sh/helm/v3/pkg/lint/rules",
+            "symbols": [
+              "Chartfile",
+              "Dependencies",
+              "Templates",
+              "TemplatesWithKubeVersion",
+              "validateChartName"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2554"
+  }
+}

data/reports/GO-2024-2554.yaml

@@ -0,0 +1,35 @@
+id: GO-2024-2554
+modules:
+    - module: helm.sh/helm/v3
+      versions:
+        - fixed: 3.14.1
+      vulnerable_at: 3.14.0
+      packages:
+        - package: helm.sh/helm/v3/pkg/chart
+          symbols:
+            - Metadata.Validate
+          derived_symbols:
+            - Chart.Validate
+        - package: helm.sh/helm/v3/pkg/chartutil
+          symbols:
+            - SaveDir
+            - writeTarContents
+          derived_symbols:
+            - CreateFrom
+            - Save
+        - package: helm.sh/helm/v3/pkg/lint/rules
+          symbols:
+            - validateChartName
+          derived_symbols:
+            - Chartfile
+            - Dependencies
+            - Templates
+            - TemplatesWithKubeVersion
+summary: Path traversal in helm.sh/helm/v3
+cves:
+    - CVE-2024-25620
+ghsas:
+    - GHSA-v53g-5gjp-272r
+references:
+    - advisory: https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r
+    - fix: https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503