From 4685b5eb84eddf89210fddbce382c7cbba51ea44 Mon Sep 17 00:00:00 2001
From: Weston Steimel <commits@weston.slmail.me>
Date: Tue, 4 Jun 2024 18:47:35 +0100
Subject: [PATCH] enrich CVE-2024-3817 for HashiCorp go-getter

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
---
 data/anchore/2024/CVE-2024-3817.json | 45 ++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 data/anchore/2024/CVE-2024-3817.json

diff --git a/data/anchore/2024/CVE-2024-3817.json b/data/anchore/2024/CVE-2024-3817.json
new file mode 100644
index 00000000..45e1a461
--- /dev/null
+++ b/data/anchore/2024/CVE-2024-3817.json
@@ -0,0 +1,45 @@
+{
+  "additionalMetadata": {
+    "cna": "hashicorp",
+    "cveId": "CVE-2024-3817",
+    "reason": "Added CPE configurations because not yet analyzed by NVD.",
+    "references": [
+      "https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040"
+    ]
+  },
+  "adp": {
+    "affected": [
+      {
+        "collectionURL": "https://pkg.go.dev",
+        "cpes": [
+          "cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*"
+        ],
+        "packageName": "github.com/hashicorp/go-getter",
+        "platforms": [
+          "32 bit",
+          "64 bit",
+          "ARM",
+          "Linux",
+          "MacOS",
+          "Windows",
+          "x86"
+        ],
+        "product": "Go Getter",
+        "repo": "https://github.com/hashicorp/go-getter",
+        "vendor": "HashiCorp",
+        "versions": [
+          {
+            "lessThan": "1.7.3",
+            "status": "affected",
+            "version": "1.5.9",
+            "versionType": "semver"
+          }
+        ]
+      }
+    ],
+    "providerMetadata": {
+      "orgId": "00000000-0000-4000-8000-000000000000",
+      "shortName": "anchoreadp"
+    }
+  }
+}
\ No newline at end of file