StackRadar

CVE-2024-3817

Critical

Advisory

Published 17 Apr 2024In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.013
69th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,781 indexed, latest versions
Container images
25
deployed by those charts
Fix available
1 of 1
affected package

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 25 images.

Affected packageAffected versionsFixed inImages
github.com/hashicorp/go-gettergolangv1.5.9, v1.5.10, v1.6.2, v1.7.0+3 more1.7.425
OSV records
GHSA-q64h-39hv-4cf7
Also known as
GO-2024-2800

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
github.com/hashicorp/go-getter@v1.7.0
1.7.4

Open the chart page →

4,167
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/hashicorp/go-getter@v1.7.2
1.7.4

Open the chart page →

2,898
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

5,598
artifact-hubsoftonic1.19.02 of 8See more

artifact-hub softonic 1.19.0

2 of the 8 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
github.com/hashicorp/go-getter@v1.7.1
1.7.4
artifacthub/scanner:v1.19.0323d026e78c3
github.com/hashicorp/go-getter@v1.7.3
1.7.4

Open the chart page →

14,491
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/hashicorp/go-getter@v1.7.0
1.7.4

Open the chart page →

2,527
kubedb-provider-azureappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

2,705
kubedb-provider-gcpappscodeVerified publisher2026.7.101 of 2See more

kubedb-provider-gcp appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

3,033
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

2,796
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

2,716
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

2,743
botkubeaveshaVerified publisher1.0.01 of 2See more

botkube avesha 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/kubeshop/botkube:v1.0.0669e27a5d1af
github.com/hashicorp/go-getter@v1.7.0
1.7.4

Open the chart page →

5,074
terraboardcamptocamp32.4.01 of 1See more

terraboard camptocamp3 2.4.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/hashicorp/go-getter@v1.7.3
1.7.4

Open the chart page →

1,330
iteration-zerocloud-native-toolkit0.2.01 of 1See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/hashicorp/go-getter@v1.5.9
1.7.4

Open the chart page →

6,921
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.4

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.4

Open the chart page →

68,240
apm-hubflanksourceVerified publisher0.0.471 of 2See more

apm-hub flanksource 0.0.47

1 of the 2 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/hashicorp/go-getter@v1.7.1
1.7.4

Open the chart page →

6,078
kubeclaritykubeclarity2.23.31 of 5See more

kubeclarity kubeclarity 2.23.3

1 of the 5 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/hashicorp/go-getter@v1.7.2
1.7.4

Open the chart page →

5,496
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

17,798
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/hashicorp/go-getter@v1.6.2
1.7.4

Open the chart page →

4,271
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/hashicorp/go-getter@v1.7.2
1.7.4

Open the chart page →

9,774
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/hashicorp/go-getter@v1.5.10
1.7.4

Open the chart page →

8,599
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.4

Open the chart page →

68,240
hermitcrabseal-ioVerified publisher0.1.41 of 2See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
github.com/hashicorp/go-getter@v1.7.0
1.7.4

Open the chart page →

4,881
keycloak-configuratorsikalabs0.2.01 of 1See more

keycloak-configurator sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
hashicorp/terraform:1.44dcb45513699
github.com/hashicorp/go-getter@v1.7.0
1.7.4

Open the chart page →

2,863
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/hashicorp/go-getter@v1.7.1
1.7.4

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2024-3817.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/hashicorp/go-getter@v1.7.1
1.7.4

Open the chart page →

2,505

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.4
3
aquasec/trivy:0.43.1944a04445179
github.com/hashicorp/go-getter@v1.7.1
1.7.4
1
aquasec/trivy:0.32.0973d0df16189
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/hashicorp/go-getter@v1.7.3
1.7.4
1
devopstales/trivy-operator:2.575136aa7a26e
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/hashicorp/go-getter@v1.7.1
1.7.4
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/hashicorp/go-getter@v1.7.1
1.7.4
1
hashicorp/terraform:1.44dcb45513699
github.com/hashicorp/go-getter@v1.7.0
1.7.4
1
hashicorp/waypoint:0.11.397d521a27498
github.com/hashicorp/go-getter@v1.7.0
1.7.4
1
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
github.com/hashicorp/go-getter@v1.7.0
1.7.4
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/hashicorp/go-getter@v1.7.1
1.7.4
1
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/hashicorp/go-getter@v1.7.2
1.7.4
1
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/hashicorp/go-getter@v1.7.3
1.7.4
1
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/hashicorp/go-getter@v1.7.0
1.7.4
1
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
github.com/hashicorp/go-getter@v1.6.2
1.7.4
1
ghcr.io/kubeshop/botkube:v1.0.0669e27a5d1af
github.com/hashicorp/go-getter@v1.7.0
1.7.4
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/hashicorp/go-getter@v1.7.2
1.7.4
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/hashicorp/go-getter@v1.7.2
1.7.4
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/hashicorp/go-getter@v1.5.9
1.7.4
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/hashicorp/go-getter@v1.5.10
1.7.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.