chartmuseum.advisories.yaml

schema-version: 2.0.2

package:
  name: chartmuseum

advisories:
  - id: CVE-2019-25210
    aliases:
      - GHSA-jw44-4f3j-q396
    events:
      - timestamp: 2024-03-06T07:07:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: chartmuseum
            componentID: 74fa33a8adb2eaff
            componentName: helm.sh/helm/v3
            componentVersion: v3.14.2
            componentType: go-module
            componentLocation: /usr/bin/chartmuseum
            scanner: grype
      - timestamp: 2024-03-14T23:58:39Z
        type: false-positive-determination
        data:
          type: vulnerability-record-analysis-contested
          note: 'This is not a vulnerability. Learn more about the response from Helm: https://helm.sh/blog/response-cve-2019-25210'

  - id: CVE-2023-39325
    aliases:
      - GHSA-4374-p667-p6c8
    events:
      - timestamp: 2023-10-13T16:43:17Z
        type: fixed
        data:
          fixed-version: 0.16.0-r6

  - id: CVE-2023-3978
    aliases:
      - GHSA-2wrh-6pvc-2jm9
    events:
      - timestamp: 2023-10-13T16:44:30Z
        type: fixed
        data:
          fixed-version: 0.16.0-r6

  - id: CVE-2023-45283
    aliases:
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:24:12Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CVE-2023-45284
    aliases:
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:24:14Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CVE-2023-45288
    aliases:
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-13T07:09:07Z
        type: fixed
        data:
          fixed-version: 0.16.1-r8

  - id: CVE-2023-45289
    aliases:
      - GHSA-32ch-6x54-q4h9
    events:
      - timestamp: 2024-03-12T07:11:39Z
        type: fixed
        data:
          fixed-version: 0.16.1-r4

  - id: CVE-2023-45290
    aliases:
      - GHSA-rr6r-cfgf-gc6h
    events:
      - timestamp: 2024-03-12T07:11:40Z
        type: fixed
        data:
          fixed-version: 0.16.1-r4

  - id: CVE-2024-24557
    aliases:
      - GHSA-xw73-rw38-6vjc
    events:
      - timestamp: 2024-03-22T07:18:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: chartmuseum
            componentID: e8713d467cb089c5
            componentName: github.com/docker/docker
            componentVersion: v24.0.7+incompatible
            componentType: go-module
            componentLocation: /usr/bin/chartmuseum
            scanner: grype

  - id: CVE-2024-24783
    aliases:
      - GHSA-3q2c-pvp5-3cqp
    events:
      - timestamp: 2024-03-12T07:11:42Z
        type: fixed
        data:
          fixed-version: 0.16.1-r4

  - id: CVE-2024-24784
    aliases:
      - GHSA-fgq5-q76c-gx78
    events:
      - timestamp: 2024-03-12T07:11:37Z
        type: fixed
        data:
          fixed-version: 0.16.1-r4

  - id: CVE-2024-24785
    aliases:
      - GHSA-j6m3-gc37-6r6q
    events:
      - timestamp: 2024-03-12T07:11:38Z
        type: fixed
        data:
          fixed-version: 0.16.1-r4

  - id: CVE-2024-24786
    aliases:
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:08:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: chartmuseum
            componentID: 03eb8e87cf063a9d
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/bin/chartmuseum
            scanner: grype
      - timestamp: 2024-03-14T15:22:59Z
        type: fixed
        data:
          fixed-version: 0.16.1-r5

  - id: CVE-2024-25620
    aliases:
      - GHSA-v53g-5gjp-272r
    events:
      - timestamp: 2024-02-16T07:23:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: chartmuseum
            componentID: b5a9321567f6fc7d
            componentName: helm.sh/helm/v3
            componentVersion: v3.12.3
            componentType: go-module
            componentLocation: /usr/bin/chartmuseum
            scanner: grype
      - timestamp: 2024-02-16T12:51:01Z
        type: fixed
        data:
          fixed-version: 0.16.1-r2

  - id: CVE-2024-26147
    aliases:
      - GHSA-r53h-jv2g-vpx6
    events:
      - timestamp: 2024-02-23T07:47:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: chartmuseum
            componentID: 7094954d3fc6b88e
            componentName: helm.sh/helm/v3
            componentVersion: v3.14.1
            componentType: go-module
            componentLocation: /usr/bin/chartmuseum
            scanner: grype
      - timestamp: 2024-02-25T12:11:33Z
        type: fixed
        data:
          fixed-version: 0.16.1-r3

  - id: GHSA-jq35-85cj-fj4p
    events:
      - timestamp: 2023-12-27T14:29:46Z
        type: fixed
        data:
          fixed-version: 0.16.0-r9