apko.advisories.yaml

schema-version: 2.0.2

package:
  name: apko

advisories:
  - id: CGA-2pv6-4gjh-fqfr
    aliases:
      - CVE-2024-41110
      - GHSA-v23v-6jw2-98fq
    events:
      - timestamp: 2024-07-31T07:29:00Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 6e842826c306e581
            componentName: github.com/docker/docker
            componentVersion: v24.0.9+incompatible
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-07-31T13:10:14Z
        type: fixed
        data:
          fixed-version: 0.17.0-r1

  - id: CGA-369f-74v7-83c6
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:03:53Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 16ae2b8adafafe37
            componentName: golang.org/x/crypto
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-12-12T11:01:37Z
        type: fixed
        data:
          fixed-version: 0.21.0-r1

  - id: CGA-386m-pr6v-7wq2
    aliases:
      - CVE-2023-49568
      - GHSA-mw99-9chc-xw7r
    events:
      - timestamp: 2023-12-29T21:34:42Z
        type: fixed
        data:
          fixed-version: 0.13.2-r0

  - id: CGA-3hhc-wp8w-cgrh
    aliases:
      - CVE-2023-30551
      - GHSA-2h5h-59f5-c5x9
    events:
      - timestamp: 2023-05-04T16:30:46Z
        type: fixed
        data:
          fixed-version: 0.8.0-r1

  - id: CGA-3jvc-525f-3ggf
    aliases:
      - CVE-2023-45283
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:22:58Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-3qp3-8vp4-hpm3
    aliases:
      - CVE-2024-34156
      - GHSA-crqm-pwhx-j97f
    events:
      - timestamp: 2024-09-10T10:09:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 874e44592f57d6ad
            componentName: stdlib
            componentVersion: go1.22.6
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-09-11T17:20:23Z
        type: fixed
        data:
          fixed-version: 0.18.0-r0

  - id: CGA-489m-x2wg-g49v
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-01-08T07:24:07Z
        type: fixed
        data:
          fixed-version: 0.22.5-r0

  - id: CGA-5383-wjhq-x4r5
    aliases:
      - CVE-2024-29903
      - GHSA-95pr-fxf5-86gv
    events:
      - timestamp: 2024-04-12T15:04:58Z
        type: fixed
        data:
          fixed-version: 0.14.0-r6

  - id: CGA-572c-x435-hwv5
    aliases:
      - CVE-2024-34155
      - GHSA-8xfx-rj4p-23jm
    events:
      - timestamp: 2024-09-10T10:09:05Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 874e44592f57d6ad
            componentName: stdlib
            componentVersion: go1.22.6
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-09-11T17:20:23Z
        type: fixed
        data:
          fixed-version: 0.18.0-r0

  - id: CGA-5m8j-x2w4-6x39
    aliases:
      - CVE-2025-22869
    events:
      - timestamp: 2025-03-06T08:03:25Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 43278732c6fc6911
            componentName: golang.org/x/crypto
            componentVersion: v0.32.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-03-20T00:28:51Z
        type: fixed
        data:
          fixed-version: 0.25.5-r0

  - id: CGA-6c34-8779-3pff
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-20T08:16:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: fce568e3868f0066
            componentName: golang.org/x/net
            componentVersion: v0.22.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-04-22T16:30:28Z
        type: fixed
        data:
          fixed-version: 0.14.0-r7

  - id: CGA-6q9p-7438-p25m
    aliases:
      - GHSA-jq35-85cj-fj4p
    events:
      - timestamp: 2023-10-31T20:03:39Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: This vulnerability is in the container runtime itself, not clients of the container runtime.

  - id: CGA-7fr2-w7x2-34w3
    aliases:
      - CVE-2023-39325
      - GHSA-4374-p667-p6c8
    events:
      - timestamp: 2023-10-13T12:38:57Z
        type: fixed
        data:
          fixed-version: 0.10.0-r6

  - id: CGA-7xf4-69xg-cp3h
    aliases:
      - CVE-2024-47534
      - GHSA-4f8r-qqr9-fq8j
    events:
      - timestamp: 2024-10-10T07:25:03Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: d7d19d54f964b304
            componentName: github.com/theupdateframework/go-tuf
            componentVersion: v0.7.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-10-10T22:21:12Z
        type: pending-upstream-fix
        data:
          note: |
            apko currently relies on an affected version of 'go-tuf', which looks to have been depreciated in favor of 'go-tuf/v2'.
            There are significant changes between these releases, and attempting to upgrade results in build errors.
            Pending fix from upstream, which will involve removing their dependency on the depreciated version.
            Related information: https://github.com/github/advisory-database/pull/4893.

  - id: CGA-8fcr-29p8-r7xg
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-01-08T07:24:00Z
        type: fixed
        data:
          fixed-version: 0.22.5-r0

  - id: CGA-f3qw-q6r9-j52v
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T07:04:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 2d524b8bccb8ad88
            componentName: golang.org/x/net
            componentVersion: v0.32.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-03-20T00:28:52Z
        type: fixed
        data:
          fixed-version: 0.25.5-r0

  - id: CGA-fr9x-mfm9-9rpj
    aliases:
      - CVE-2024-29902
      - GHSA-88jx-383q-w4qc
    events:
      - timestamp: 2024-04-12T15:04:55Z
        type: fixed
        data:
          fixed-version: 0.14.0-r6

  - id: CGA-fvwh-x5hf-34g9
    aliases:
      - GHSA-9763-4f94-gfch
    events:
      - timestamp: 2024-01-27T07:12:38Z
        type: fixed
        data:
          fixed-version: 0.13.3-r0

  - id: CGA-gjxp-xr95-gvpj
    aliases:
      - CVE-2023-28842
      - GHSA-6wrf-mxfj-pf5p
    events:
      - timestamp: 2023-04-05T14:22:32Z
        type: fixed
        data:
          fixed-version: 0.7.3-r1

  - id: CGA-hfx9-vj86-p4jp
    aliases:
      - CVE-2025-22874
      - GHSA-6f52-wpx2-hvf2
    events:
      - timestamp: 2025-06-14T07:08:53Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 7c5bcb61532676a3
            componentName: stdlib
            componentVersion: go1.24.3
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-06-14T08:48:32Z
        type: fixed
        data:
          fixed-version: 0.27.9-r1

  - id: CGA-j22j-vcxp-v9xf
    aliases:
      - CVE-2025-4673
      - GHSA-62jj-gr2r-5c34
    events:
      - timestamp: 2025-06-14T07:08:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 7c5bcb61532676a3
            componentName: stdlib
            componentVersion: go1.24.3
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-06-14T08:48:33Z
        type: fixed
        data:
          fixed-version: 0.27.9-r1

  - id: CGA-j2x5-ccf7-ghqf
    aliases:
      - CVE-2025-22868
    events:
      - timestamp: 2025-03-06T08:03:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 46c6f36364268ddf
            componentName: golang.org/x/oauth2
            componentVersion: v0.25.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-03-20T00:28:52Z
        type: fixed
        data:
          fixed-version: 0.25.5-r0

  - id: CGA-j5rx-rrgv-vwrj
    aliases:
      - CVE-2023-28841
      - GHSA-33pg-m6jh-5237
    events:
      - timestamp: 2023-04-05T14:22:32Z
        type: fixed
        data:
          fixed-version: 0.7.3-r1

  - id: CGA-jgq5-c6pr-47hp
    aliases:
      - CVE-2023-45284
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:23:00Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-jgxc-mgm2-cp8r
    aliases:
      - CVE-2024-28180
      - GHSA-c5q2-7r4c-mv6g
    events:
      - timestamp: 2024-03-08T07:12:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 617de320c10e6af0
            componentName: gopkg.in/go-jose/go-jose.v2
            componentVersion: v2.6.1
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-03-09T14:57:44Z
        type: fixed
        data:
          fixed-version: 0.14.0-r3

  - id: CGA-m59p-j794-xffc
    aliases:
      - CVE-2024-34158
      - GHSA-j7vj-rw65-4v26
    events:
      - timestamp: 2024-09-10T10:09:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 874e44592f57d6ad
            componentName: stdlib
            componentVersion: go1.22.6
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2024-09-11T17:20:24Z
        type: fixed
        data:
          fixed-version: 0.18.0-r0

  - id: CGA-mp8f-5q7x-gcgh
    aliases:
      - CVE-2023-46737
      - GHSA-vfp6-jrw2-99g9
    events:
      - timestamp: 2023-11-16T12:39:51Z
        type: fixed
        data:
          fixed-version: 0.11.3-r0

  - id: CGA-q48x-qp74-wc3c
    aliases:
      - CVE-2025-22870
      - GHSA-qxp5-gwg8-xv66
    events:
      - timestamp: 2025-03-13T13:22:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 5eca51ee09c4ebb2
            componentName: golang.org/x/net
            componentVersion: v0.35.0
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-03-20T00:28:53Z
        type: fixed
        data:
          fixed-version: 0.25.5-r0

  - id: CGA-q4mw-gpc9-v5x6
    aliases:
      - CVE-2025-27144
      - GHSA-c6gw-w398-hv78
    events:
      - timestamp: 2025-02-27T08:35:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 2c855b550725f4dc
            componentName: github.com/go-jose/go-jose/v3
            componentVersion: v3.0.3
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-02-27T17:32:00Z
        type: fixed
        data:
          fixed-version: 0.25.1-r2

  - id: CGA-rvmp-7c2w-5x25
    aliases:
      - CVE-2023-3978
      - GHSA-2wrh-6pvc-2jm9
    events:
      - timestamp: 2023-10-13T12:38:12Z
        type: fixed
        data:
          fixed-version: 0.10.0-r6

  - id: CGA-vw39-p8xw-v5hv
    aliases:
      - CVE-2023-28840
      - GHSA-232p-vwff-86mp
    events:
      - timestamp: 2023-04-05T14:22:32Z
        type: fixed
        data:
          fixed-version: 0.7.3-r1

  - id: CGA-wm5x-7j94-c6v4
    aliases:
      - CVE-2025-22866
      - GHSA-3whm-j4xm-rv8x
    events:
      - timestamp: 2025-02-08T14:24:01Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apko
            componentID: 59d7f252e98d9809
            componentName: stdlib
            componentVersion: go1.23.5
            componentType: go-module
            componentLocation: /usr/bin/apko
            scanner: grype
      - timestamp: 2025-02-09T02:14:55Z
        type: fixed
        data:
          fixed-version: 0.24.0-r1

  - id: CGA-xc48-24mh-c3jm
    aliases:
      - CVE-2023-48795
      - GHSA-45x7-px36-x8w8
    events:
      - timestamp: 2023-12-19T16:56:36Z
        type: fixed
        data:
          fixed-version: 0.12.0-r2