Backport of [NET-8174] security: add scan triage for CVE-2024-26147 (…

…helm/v3) into release/1.4.x (#3692) backport of commit 4b8bc71 Co-authored-by: Michael Zalimeni <[email protected]>
hashicorp · Feb 26, 2024 · 27d4bd3 · 27d4bd3
1 parent 09ecce2
commit 27d4bd3
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl
@@ -34,6 +34,8 @@ binary {
       vulnerabilites = [
         # NET-8174 (2024-02-20): Chart YAML path traversal (not impacted)
         "GHSA-v53g-5gjp-272r", # alias CVE-2024-25620
+        # NET-8174 (2024-02-26): Missing YAML Content Leads To Panic (requires malicious plugin)
+        "GHSA-r53h-jv2g-vpx6", # alias CVE-2024-26147
       ]
     }
   }

diff --git a/scan.hcl b/scan.hcl
@@ -33,7 +33,9 @@ repository {
       ]
       vulnerabilites = [
         # NET-8174 (2024-02-20): Chart YAML path traversal (not impacted)
-		"GHSA-v53g-5gjp-272r", # alias CVE-2024-25620
+        "GHSA-v53g-5gjp-272r", # alias CVE-2024-25620
+        # NET-8174 (2024-02-26): Missing YAML Content Leads To Panic (requires malicious plugin)
+        "GHSA-r53h-jv2g-vpx6", # alias CVE-2024-26147
       ]
     }
   }