argo-cd-2.7.advisories.yaml

schema-version: 2.0.2

package:
  name: argo-cd-2.7

advisories:
  - id: CGA-35x9-fqrw-7fr3
    aliases:
      - CVE-2024-32476
      - GHSA-9m6p-x4h2-6frq
    events:
      - timestamp: 2025-03-04T18:03:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2db0198c24b45e47
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-3g23-93mw-335w
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2025-03-04T18:06:28Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-3vch-5jm5-7849
    aliases:
      - CVE-2025-0426
      - GHSA-jgfp-53c3-624w
    events:
      - timestamp: 2025-03-04T18:04:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 3236935c8a384429
            componentName: k8s.io/kubernetes
            componentVersion: v1.24.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-3xcp-3675-fc3v
    aliases:
      - CVE-2025-22869
    events:
      - timestamp: 2025-03-04T18:02:06Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 65f0040b48c58391
            componentName: golang.org/x/crypto
            componentVersion: v0.17.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-54g8-jwm3-m68x
    aliases:
      - CVE-2023-49568
      - GHSA-mw99-9chc-xw7r
    events:
      - timestamp: 2023-12-28T17:54:38Z
        type: fixed
        data:
          fixed-version: 2.7.15-r7

  - id: CGA-623v-mrm7-2cmg
    aliases:
      - CVE-2024-3177
      - GHSA-pxhw-596r-rwq5
    events:
      - timestamp: 2025-03-04T18:04:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 3236935c8a384429
            componentName: k8s.io/kubernetes
            componentVersion: v1.24.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-64vj-898p-rfv3
    aliases:
      - CVE-2024-21662
      - GHSA-2vgg-9h6w-m454
    events:
      - timestamp: 2024-03-23T07:06:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 017ef98c4182ad84
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-03-30T16:47:59Z
        type: fix-not-planned
        data:
          note: Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05.

  - id: CGA-66p5-fmrc-483r
    aliases:
      - CVE-2025-22868
    events:
      - timestamp: 2025-03-04T18:01:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: c8616bbc9665a853
            componentName: golang.org/x/oauth2
            componentVersion: v0.11.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-69mx-7x2j-r9mf
    aliases:
      - CVE-2024-6104
      - GHSA-v6v8-xj6m-xwqh
    events:
      - timestamp: 2025-03-04T18:01:47Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: b6367e21547938df
            componentName: github.com/hashicorp/go-retryablehttp
            componentVersion: v0.7.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-7vw5-w2vc-frm6
    aliases:
      - CVE-2024-41666
      - GHSA-v8wx-v5jq-qhhw
    events:
      - timestamp: 2025-03-04T18:05:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2db0198c24b45e47
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-8cr7-62h8-hhmh
    aliases:
      - CVE-2025-22866
      - GHSA-3whm-j4xm-rv8x
    events:
      - timestamp: 2025-03-04T18:08:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-8hjr-r378-8p4q
    aliases:
      - CVE-2024-0793
      - GHSA-h7wq-jj8r-qm7p
    events:
      - timestamp: 2025-03-04T18:03:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 3236935c8a384429
            componentName: k8s.io/kubernetes
            componentVersion: v1.24.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-94ww-2h5x-vcp5
    aliases:
      - CVE-2023-45289
      - GHSA-32ch-6x54-q4h9
    events:
      - timestamp: 2024-03-12T07:06:47Z
        type: fixed
        data:
          fixed-version: 2.7.17-r1

  - id: CGA-96vw-4r5p-59c8
    aliases:
      - CVE-2024-24784
      - GHSA-fgq5-q76c-gx78
    events:
      - timestamp: 2024-03-12T07:06:49Z
        type: fixed
        data:
          fixed-version: 2.7.17-r1

  - id: CGA-99pw-rcrv-26vp
    aliases:
      - CVE-2023-45284
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:23:04Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-9p5f-vr5c-fg78
    aliases:
      - CVE-2023-47108
      - GHSA-8pgv-569h-w5rw
    events:
      - timestamp: 2023-11-17T08:05:25Z
        type: fixed
        data:
          fixed-version: 2.7.15-r0

  - id: CGA-9v4w-mxqx-qjc6
    aliases:
      - CVE-2023-3978
      - GHSA-2wrh-6pvc-2jm9
    events:
      - timestamp: 2023-10-13T12:38:13Z
        type: fixed
        data:
          fixed-version: 2.7.14-r5

  - id: CGA-9wp2-8p2h-gc4w
    aliases:
      - CVE-2024-24783
      - GHSA-3q2c-pvp5-3cqp
    events:
      - timestamp: 2024-03-12T07:06:53Z
        type: fixed
        data:
          fixed-version: 2.7.17-r1

  - id: CGA-c4q2-94w8-9g68
    aliases:
      - CVE-2024-10220
      - GHSA-27wf-5967-98gx
    events:
      - timestamp: 2025-03-04T18:02:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 3236935c8a384429
            componentName: k8s.io/kubernetes
            componentVersion: v1.24.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-c57w-v286-wcm7
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-03-04T18:05:07Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 7eb528cfa6e393c6
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.11.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-c624-3cgp-8xg3
    aliases:
      - CVE-2024-31989
      - GHSA-9766-5277-j5hr
    events:
      - timestamp: 2025-03-04T18:03:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2db0198c24b45e47
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-cc4r-7cw5-727c
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2025-03-04T18:06:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-frwj-w553-37p5
    aliases:
      - CVE-2024-21661
      - GHSA-6v85-wr92-q4p7
    events:
      - timestamp: 2025-03-04T18:02:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2db0198c24b45e47
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-fv69-jpmq-6cc2
    aliases:
      - CVE-2021-25743
      - GHSA-f9jg-8p32-2f55
    events:
      - timestamp: 2023-10-03T20:05:42Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: The vulnerable code is specific to kubectl.

  - id: CGA-gfpx-r7p8-xhq3
    aliases:
      - CVE-2023-45283
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:23:02Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-ghvq-f7r3-xgmf
    aliases:
      - CVE-2024-34156
      - GHSA-crqm-pwhx-j97f
    events:
      - timestamp: 2025-03-04T18:07:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-gv75-8j9w-mv6f
    aliases:
      - CVE-2024-31990
      - GHSA-2gvw-w6fj-7m3c
    events:
      - timestamp: 2024-04-16T09:51:28Z
        type: fix-not-planned
        data:
          note: Argo-CD 2.7 is no longer supported upstream.

  - id: CGA-gx9f-j5jj-84j4
    aliases:
      - CVE-2025-23216
      - GHSA-47g2-qmh2-749v
    events:
      - timestamp: 2025-03-04T18:02:47Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2db0198c24b45e47
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2025-06-17T00:15:38Z
        type: fix-not-planned
        data:
          note: Argo-CD 2.7 is no longer supported upstream.

  - id: CGA-hh36-8gcc-wcq3
    aliases:
      - CVE-2020-8552
      - GHSA-82hx-w2r5-c2wq
    events:
      - timestamp: 2023-09-19T16:38:22Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Go vulndb has marked this code NOT_IMPORTABLE.

  - id: CGA-hjfv-3464-gw5w
    aliases:
      - CVE-2024-21652
      - GHSA-x32m-mvfj-52xv
    events:
      - timestamp: 2024-03-19T07:07:24Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7-compat
            componentID: 68fa0dc01d78a74b
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-03-30T16:47:59Z
        type: fix-not-planned
        data:
          note: Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05.
      - timestamp: 2025-06-16T21:03:25Z
        type: fix-not-planned
        data:
          note: 'Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05. '

  - id: CGA-hqqq-gf45-qwqq
    aliases:
      - CVE-2023-48795
      - GHSA-45x7-px36-x8w8
    events:
      - timestamp: 2023-12-19T18:22:31Z
        type: fixed
        data:
          fixed-version: 2.7.15-r6

  - id: CGA-j546-7ccp-93jq
    aliases:
      - CVE-2023-45290
      - GHSA-rr6r-cfgf-gc6h
    events:
      - timestamp: 2024-03-12T07:06:51Z
        type: fixed
        data:
          fixed-version: 2.7.17-r1

  - id: CGA-j8wx-9mhc-2r24
    aliases:
      - CVE-2023-5528
      - GHSA-hq6q-c2x6-hmch
    events:
      - timestamp: 2023-11-17T08:24:23Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: This vulnerability affects the Kubernetes application, not the golang k8s.io/kubernetes library. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

  - id: CGA-jfxc-mh76-f83w
    aliases:
      - CVE-2023-44487
      - GHSA-m425-mq94-257g
      - GHSA-qppj-fm5r-hxr3
    events:
      - timestamp: 2023-10-30T10:59:43Z
        type: fixed
        data:
          fixed-version: 2.7.14-r7

  - id: CGA-m68m-65rp-789r
    aliases:
      - CVE-2024-45336
      - GHSA-7wrw-r4p8-38rx
    events:
      - timestamp: 2025-03-04T18:08:00Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-m726-9rmc-6jc3
    aliases:
      - CVE-2024-45341
      - GHSA-3f6r-qh9c-x6mm
    events:
      - timestamp: 2025-03-04T18:08:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-p57p-9876-69wf
    aliases:
      - CVE-2023-46402
      - GHSA-3f2q-6294-fmq5
    events:
      - timestamp: 2023-12-03T14:31:09Z
        type: fixed
        data:
          fixed-version: 2.7.15-r2

  - id: CGA-p7wj-3j5m-f86p
    aliases:
      - CVE-2024-28180
      - GHSA-c5q2-7r4c-mv6g
    events:
      - timestamp: 2025-03-04T18:03:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: dbd29a6d700941aa
            componentName: gopkg.in/square/go-jose.v2
            componentVersion: v2.6.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-phj3-9c2g-6mq2
    aliases:
      - CVE-2024-34158
      - GHSA-j7vj-rw65-4v26
    events:
      - timestamp: 2025-03-04T18:07:41Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-pp8r-2323-56ww
    aliases:
      - CVE-2024-40634
      - GHSA-jmvp-698c-4x3w
    events:
      - timestamp: 2025-03-04T18:04:24Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2db0198c24b45e47
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-pq56-5qc6-86vw
    aliases:
      - CVE-2024-34155
      - GHSA-8xfx-rj4p-23jm
    events:
      - timestamp: 2025-03-04T18:07:04Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-pqrv-vw66-3c9h
    aliases:
      - CVE-2024-24785
      - GHSA-j6m3-gc37-6r6q
    events:
      - timestamp: 2024-03-12T07:06:45Z
        type: fixed
        data:
          fixed-version: 2.7.17-r1

  - id: CGA-q28h-5346-r2m9
    aliases:
      - CVE-2024-24786
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T13:19:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7-compat
            componentID: 72e491103edad45d
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-03-30T16:47:59Z
        type: fix-not-planned
        data:
          note: Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05.

  - id: CGA-q54m-4h74-5fvx
    aliases:
      - CVE-2024-5321
      - GHSA-82m2-cv7p-4m75
    events:
      - timestamp: 2025-03-04T18:03:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 3236935c8a384429
            componentName: k8s.io/kubernetes
            componentVersion: v1.24.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-qjj2-3547-4cg5
    aliases:
      - CVE-2023-50726
      - GHSA-g623-jcgg-mhmm
    events:
      - timestamp: 2024-03-16T07:04:51Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 017ef98c4182ad84
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-03-30T16:47:59Z
        type: fix-not-planned
        data:
          note: Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05.

  - id: CGA-qp72-7hcv-9wg5
    aliases:
      - CVE-2024-29893
      - GHSA-jhwx-mhww-rgc3
    events:
      - timestamp: 2024-04-04T07:53:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7-compat
            componentID: 68fa0dc01d78a74b
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-04-16T09:31:21Z
        type: fix-not-planned
        data:
          note: Argo-CD 2.7 is no longer supported upstream.

  - id: CGA-qv74-65f2-x8w5
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-03-04T18:04:52Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 7eb528cfa6e393c6
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.11.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-r228-g3wr-v93x
    aliases:
      - CVE-2023-39325
      - GHSA-4374-p667-p6c8
    events:
      - timestamp: 2023-10-13T12:38:59Z
        type: fixed
        data:
          fixed-version: 2.7.14-r5

  - id: CGA-rf3j-869x-h6xf
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-13T07:40:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 2fbccdc8507aadf0
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-04-13T22:10:52Z
        type: fix-not-planned
        data:
          note: Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05.

  - id: CGA-rm8v-8fqr-6q8w
    aliases:
      - CVE-2024-24787
      - GHSA-5fq7-4mxc-535h
    events:
      - timestamp: 2025-03-04T18:05:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-rqx6-rc2f-8mgj
    aliases:
      - GHSA-274v-mgcv-cm8j
    events:
      - timestamp: 2025-03-04T18:02:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: d17ffba31e69d16d
            componentName: github.com/argoproj/gitops-engine
            componentVersion: v0.7.1-0.20230526233214-ad9a694fe4bc
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-rwqc-xphm-3cr7
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2025-03-04T18:01:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: fceaac64b013306e
            componentName: golang.org/x/net
            componentVersion: v0.19.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-vgg7-98fq-pghc
    aliases:
      - CVE-2024-28175
      - GHSA-jwv5-8mqv-g387
    events:
      - timestamp: 2024-03-16T07:04:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 017ef98c4182ad84
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.7.17
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-03-30T16:47:59Z
        type: fix-not-planned
        data:
          note: Argo CD 2.7 is longer supported. Security Support ended on 2024-02-05.

  - id: CGA-vrf6-92c4-9grf
    aliases:
      - CVE-2024-24788
      - GHSA-2jwv-jmq4-4j3r
    events:
      - timestamp: 2025-03-04T18:05:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-vx57-gmr4-gfqv
    aliases:
      - GHSA-6xv5-86q9-7xr8
    events:
      - timestamp: 2023-09-09T15:17:59Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: This vulnerability is only present on Windows.

  - id: CGA-w437-p79w-vf46
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2025-03-04T18:01:29Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 65f0040b48c58391
            componentName: golang.org/x/crypto
            componentVersion: v0.17.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-w6wg-63f3-6vq2
    aliases:
      - CVE-2024-22424
      - GHSA-92mw-q256-5vwg
    events:
      - timestamp: 2024-01-24T07:04:41Z
        type: fixed
        data:
          fixed-version: 2.7.16-r0

  - id: CGA-x72v-4m49-rqcv
    aliases:
      - CVE-2024-51744
      - GHSA-29wx-vh33-7x7r
    events:
      - timestamp: 2025-03-04T18:02:37Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 59c85bd8cc37d00a
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.4.3
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype

  - id: CGA-xh7c-m4vq-qg86
    aliases:
      - CVE-2023-3955
      - GHSA-q78c-gwqw-jcmc
    events:
      - timestamp: 2023-11-02T13:04:05Z
        type: fixed
        data:
          fixed-version: 2.7.14-r8

  - id: CGA-xxq4-j9vg-238h
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2025-03-04T18:06:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.7
            componentID: 4114e0bc16861d13
            componentName: stdlib
            componentVersion: go1.22.1
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype