StackRadarChart IndexLive demo

CVE-2023-0475

Medium

Advisory

Published 16 Feb 2023In the index since 8 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.2; base score, highest
EPSS: 0.005; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 18; deployed by those charts
Fix available: 1 of 1; affected package

Data Amplification in HashiCorp go-getter

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 18 images.

Affected package	Affected versions	Fixed in	Images
github.com/hashicorp/go-gettergolang	v1.4.0, v1.4.1, v1.5.1, v1.5.2+4 more	1.7.0	18

OSV records: GHSA-jpxj-2jvg-6jv9
Also known as: GO-2023-1578

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

trivy-operatordevopstales

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

5,598

1 of 1 See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
runatlantis/atlantis :v0.16.1	45fbaf7e207c	github.com/hashicorp/go-getter@v1.5.1	1.7.0

Open the chart page →

5,280

kubedb-provider-azureappscode

1 of 1 See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
ghcr.io/kubedb/provider-azure :v0.27.0	aa0c8526ae5e	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

2,705

kubedb-provider-gcpappscode

1 of 2 See more

kubedb-provider-gcp appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
ghcr.io/kubedb/provider-gcp :v0.27.0	a1d4cf8b8fe1	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

3,033

kubeform-provider-awsappscode

1 of 1 See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
ghcr.io/kubeform/provider-aws :v0.0.1	e3d1f1302e49	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

2,796

kubeform-provider-azureappscode

1 of 1 See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
ghcr.io/kubeform/provider-azure :v0.0.1	ac8459f70f85	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

2,716

kubeform-provider-gcpappscode

1 of 1 See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
ghcr.io/kubeform/provider-gcp :v0.0.1	af77073c184f	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

2,743

harbor-scanner-trivyaqua-helm

1 of 1 See more

harbor-scanner-trivy aqua-helm 0.17.0

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.20.0	7ea4aa3d2eb6	github.com/hashicorp/go-getter@v1.5.2	1.7.0

Open the chart page →

5,202

ibm-toolkit-installcloud-native-toolkit

1 of 1 See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	github.com/hashicorp/go-getter@v1.5.2	1.7.0

Open the chart page →

6,695

iteration-zerocloud-native-toolkit

1 of 1 See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
quay.io/cloudnativetoolkit/cli-tools :v1.1-v1.8.2	d6fd2a9e3273	github.com/hashicorp/go-getter@v1.5.7	1.7.0

Open the chart page →

6,921

fickyhelmappfickyhelmapp

1 of 1 See more

fickyhelmapp fickyhelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
tundeficky/nodejs-app :v1.0.0	3cf9a9ce54e8	github.com/hashicorp/go-getter@v1.5.4	1.7.0

Open the chart page →

3,311

pipecdkrzwiatrzyk

1 of 3 See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
ghcr.io/pipe-cd/pipecd :v0.39.0	0fae829caf29	github.com/hashicorp/go-getter@v1.4.0	1.7.0

Open the chart page →

3,812

harborkubesphere

1 of 11 See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
goharbor/trivy-adapter-photon :v2.5.3	b9522c3f5056	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

17,798

trivy-serverlemontech

1 of 1 See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.32.0	973d0df16189	github.com/hashicorp/go-getter@v1.6.2	1.7.0

Open the chart page →

4,271

myhelmappmyhelmapp

1 of 1 See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
tobirachel/node-project3 :v1	7d9f37154994	github.com/hashicorp/go-getter@v1.5.4	1.7.0

Open the chart page →

3,359

anchore-engineopencloudcx

1 of 2 See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
anchore/anchore-engine :v0.10.0	bde9eedf639d	github.com/hashicorp/go-getter@v1.4.1	1.7.0

Open the chart page →

18,023

redhat-trusted-application-pipelineopenshift

1 of 2 See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	github.com/hashicorp/go-getter@v1.5.10	1.7.0

Open the chart page →

8,599

stackrox-chartredhat-cop

1 of 1 See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2023-0475.

Container image	Digest	Package	Fixed in
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/hashicorp/go-getter@v1.5.2	1.7.0

Open the chart page →

29,227

Container images carrying it

18 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
anchore/anchore-engine :v0.10.0	bde9eedf639d	github.com/hashicorp/go-getter@v1.4.1	1.7.0	1
aquasec/harbor-scanner-trivy :0.20.0	7ea4aa3d2eb6	github.com/hashicorp/go-getter@v1.5.2	1.7.0	1
aquasec/trivy :0.32.0	973d0df16189	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
devopstales/trivy-operator :2.5	75136aa7a26e	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
goharbor/trivy-adapter-photon :v2.5.3	b9522c3f5056	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
runatlantis/atlantis :v0.16.1	45fbaf7e207c	github.com/hashicorp/go-getter@v1.5.1	1.7.0	1
tobirachel/node-project3 :v1	7d9f37154994	github.com/hashicorp/go-getter@v1.5.4	1.7.0	1
tundeficky/nodejs-app :v1.0.0	3cf9a9ce54e8	github.com/hashicorp/go-getter@v1.5.4	1.7.0	1
ghcr.io/kubedb/provider-azure :v0.27.0	aa0c8526ae5e	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
ghcr.io/kubedb/provider-gcp :v0.27.0	a1d4cf8b8fe1	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
ghcr.io/kubeform/provider-aws :v0.0.1	e3d1f1302e49	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
ghcr.io/kubeform/provider-azure :v0.0.1	ac8459f70f85	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
ghcr.io/kubeform/provider-gcp :v0.0.1	af77073c184f	github.com/hashicorp/go-getter@v1.6.2	1.7.0	1
ghcr.io/pipe-cd/pipecd :v0.39.0	0fae829caf29	github.com/hashicorp/go-getter@v1.4.0	1.7.0	1
quay.io/cloudnativetoolkit/cli-tools :v1.1-v1.8.2	d6fd2a9e3273	github.com/hashicorp/go-getter@v1.5.7	1.7.0	1
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	github.com/hashicorp/go-getter@v1.5.2	1.7.0	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	github.com/hashicorp/go-getter@v1.5.10	1.7.0	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/hashicorp/go-getter@v1.5.2	1.7.0	1