x/vulndb: potential Go vuln in helm.sh/helm/v3: GHSA-67fx-wx78-jx33

[GoVulnBot]

In GitHub Security Advisory GHSA-67fx-wx78-jx33, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
helm.sh/helm/v3	3.10.3	<= 3.10.2

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: TODO (earliest fixed "3.10.3", vuln range "<= 3.10.2")
    packages:
      - package: helm.sh/helm/v3
description: "Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input
    to functions in the _chartutil_ package that can cause a segmentation violation.
    Applications that use functions from the _chartutil_ package in the Helm SDK can
    have a Denial of Service attack when they use this package and it panics.\n\n###
    Impact\n\nThe _chartutil_ package contains a parser that loads a JSON Schema validation
    file. For example, the Helm client when rendering a chart will validate its values
    with the schema file. The _chartutil_ package parses the schema file and loads
    it into structures Go can work with. Some schema files can cause array data structures
    to be created causing a memory violation.\n\nApplications that use the _chartutil_
    package in the Helm SDK to parse a schema file can suffer a Denial of Service
    when that input causes a panic that cannot be recovered from.\n\nThe Helm Client
    will panic with a schema file that causes a memory violation panic. Helm is not
    a long running service so the panic will not affect future uses of the Helm client.\n\n###
    Patches\n\nThis issue has been resolved in 3.10.3. \n\n### Workarounds\n\nSDK
    users can validate schema files that are correctly formatted before passing them
    to the _chartutil_ functions.\n\n### For more information\n\nHelm's security policy
    is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md)
    document.\n\n### Credits\n\nDisclosed by Ada Logics in a fuzzing audit sponsored
    by CNCF."
cves:
  - CVE-2022-23526
ghsas:
  - GHSA-67fx-wx78-jx33

[gopherbot]

Change https://go.dev/cl/459221 mentions this issue: data/reports: add GO-2022-1166.yaml