x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-53c4-hhmh-vw5q

[GoVulnBot]

In GitHub Security Advisory GHSA-53c4-hhmh-vw5q, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
helm.sh/helm/v3	3.10.3	<= 3.10.2

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: TODO (earliest fixed "3.10.3", vuln range "<= 3.10.2")
    packages:
      - package: helm.sh/helm/v3
description: "Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input
    to functions in the _repo_ package that can cause a segmentation violation. Applications
    that use functions from the _repo_ package in the Helm SDK can have a Denial of
    Service attack when they use this package and it panics.\n\n### Impact\n\nThe
    _repo_ package contains a handler that processes the index file of a repository.
    For example, the Helm client adds references to chart repositories where charts
    are managed. The _repo_ package parses the index file of the repository and loads
    it into structures Go can work with. Some index files can cause array data structures
    to be created causing a memory violation.\n\nApplications that use the _repo_
    package in the Helm SDK to parse an index file can suffer a Denial of Service
    when that input causes a panic that cannot be recovered from.\n\nThe Helm Client
    will panic with an index file that causes a memory violation panic. Helm is not
    a long running service so the panic will not affect future uses of the Helm client.\n\n###
    Patches\n\nThis issue has been resolved in 3.10.3. \n\n### Workarounds\n\nSDK
    users can validate index files that are correctly formatted before passing them
    to the _repo_ functions.\n\n### For more information\n\nHelm's security policy
    is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md)
    document.\n\n### Credits\n\nDisclosed by Ada Logics in a fuzzing audit sponsored
    by CNCF."
cves:
  - CVE-2022-23525
ghsas:
  - GHSA-53c4-hhmh-vw5q

[gopherbot]

Change https://go.dev/cl/459222 mentions this issue: data/reports: add GO-2022-1165.yaml