advisories/argo-cd-2.13.advisories.yaml at main · mjramirez-dev/advisories · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
schema-version: 2.0.2

package:
  name: argo-cd-2.13

advisories:
  - id: CGA-7xh8-794m-627j
    aliases:
      - CVE-2024-35255
      - GHSA-m5vv-6r4h-3vj9
    events:
      - timestamp: 2024-11-06T09:03:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13-repo-server
            componentID: 8c834c4ead047f14
            componentName: github.com/Azure/azure-sdk-for-go/sdk/azidentity
            componentVersion: v1.1.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-11-18T20:03:39Z
        type: fixed
        data:
          fixed-version: 2.13.0-r1

  - id: CGA-875c-5xx8-qwjf
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T21:12:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 0b45878c6faef543
            componentName: golang.org/x/net
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-12-20T15:32:32Z
        type: fixed
        data:
          fixed-version: 2.13.2-r2

  - id: CGA-8q29-mfm7-2fhm
    aliases:
      - GHSA-274v-mgcv-cm8j
    events:
      - timestamp: 2025-01-31T07:06:56Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: e63a4d860153a27c
            componentName: github.com/argoproj/gitops-engine
            componentVersion: v0.7.1-0.20250129155113-4c6e03c46314
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-02-03T22:58:47Z
        type: pending-upstream-fix
        data:
          note: The gitops-engine@v0.7.3 has breaking changes, upstream maintainers will have to address required changes from version v0.7.1-0.20250129155113-faf5a4e5c37d.'
      - timestamp: 2025-02-05T21:04:05Z
        type: fixed
        data:
          fixed-version: 2.13.4-r0
      - timestamp: 2025-02-07T07:29:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 5f9db2db2d22516e
            componentName: github.com/argoproj/gitops-engine
            componentVersion: v0.7.1-0.20250129155113-4c6e03c46314
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-04-03T15:59:47Z
        type: pending-upstream-fix
        data:
          note: pending-upstream-fix is still applicable. The gitops-engine@v0.7.3 has breaking changes, upstream maintainers will have to address required changes from version v0.7.1-0.20250129155113-faf5a4e5c37d.'

  - id: CGA-gc77-5phf-vxm8
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-01-07T07:21:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 892ee794f182bbfd
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-01-07T14:42:16Z
        type: fixed
        data:
          fixed-version: 2.13.3-r1

  - id: CGA-h8m3-hx96-fxpf
    aliases:
      - CVE-2025-23216
      - GHSA-47g2-qmh2-749v
    events:
      - timestamp: 2025-01-31T07:08:51Z
        type: fixed
        data:
          fixed-version: 2.13.4-r0
      - timestamp: 2025-06-16T21:39:40Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: |-
            Argoproject has fixed CVE-2025-23216 in the GitOps Engine repository with commit https://github.com/argoproj/gitops-engine/commit/faf5a4e5c37d22fedaa2726b430af5b5ae9e567a.
            However, a new version tag was never generated and versions of ArgoCD were updated with the specific hash but through "go get github.com/argoproj/gitops-engine@faf5a4e5c37d22fedaa2726b430af5b5ae9e567a" which
            appends the date + hash on-top of the current version tag, in this case updated v0.7.1-0.20240714153147-adb68bcaab73 to v0.7.1-0.20250129155113-faf5a4e5c37d, which both versions still state v0.7.1 as vulnerable. This is due to
            a limitation in scanners which utilize the semantic version to determine which versions are vulnerable and fixed. Chainguard has submitted a change request to Github tracking the vulnerablity information https://github.com/github/advisory-database/pull/5689
            Also have submitted multiple issues with upstream Argoproject/Argo-CD: https://github.com/argoproj/gitops-engine/issues/736 and https://github.com/argoproj/gitops-engine/issues/729 so the Argoproject can address the issue.
            Argo-CD version 2.11 contains the fix for this CVE as referenced by this version v0.7.1-0.20250129155113-faf5a4e5c37d or later

  - id: CGA-qmmh-7pp9-7h68
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-01-07T07:21:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 892ee794f182bbfd
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-01-07T14:42:16Z
        type: fixed
        data:
          fixed-version: 2.13.3-r1

  - id: CGA-v7rv-j84g-g5fj
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:09:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 0975cd8371881464
            componentName: golang.org/x/crypto
            componentVersion: v0.27.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-12-13T07:33:21Z
        type: fixed
        data:
          fixed-version: 2.13.2-r1