argo-cd-2.13.advisories.yaml

schema-version: 2.0.2

package:
  name: argo-cd-2.13

advisories:
  - id: CGA-7xh8-794m-627j
    aliases:
      - CVE-2024-35255
      - GHSA-m5vv-6r4h-3vj9
    events:
      - timestamp: 2024-11-06T09:03:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13-repo-server
            componentID: 8c834c4ead047f14
            componentName: github.com/Azure/azure-sdk-for-go/sdk/azidentity
            componentVersion: v1.1.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-11-18T20:03:39Z
        type: fixed
        data:
          fixed-version: 2.13.0-r1

  - id: CGA-875c-5xx8-qwjf
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T21:12:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 0b45878c6faef543
            componentName: golang.org/x/net
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-12-20T15:32:32Z
        type: fixed
        data:
          fixed-version: 2.13.2-r2

  - id: CGA-8q29-mfm7-2fhm
    aliases:
      - GHSA-274v-mgcv-cm8j
    events:
      - timestamp: 2025-01-31T07:06:56Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: e63a4d860153a27c
            componentName: github.com/argoproj/gitops-engine
            componentVersion: v0.7.1-0.20250129155113-4c6e03c46314
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-02-03T22:58:47Z
        type: pending-upstream-fix
        data:
          note: The gitops-engine@v0.7.3 has breaking changes, upstream maintainers will have to address required changes from version v0.7.1-0.20250129155113-faf5a4e5c37d.'
      - timestamp: 2025-02-05T21:04:05Z
        type: fixed
        data:
          fixed-version: 2.13.4-r0
      - timestamp: 2025-02-07T07:29:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 5f9db2db2d22516e
            componentName: github.com/argoproj/gitops-engine
            componentVersion: v0.7.1-0.20250129155113-4c6e03c46314
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype

  - id: CGA-gc77-5phf-vxm8
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-01-07T07:21:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 892ee794f182bbfd
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-01-07T14:42:16Z
        type: fixed
        data:
          fixed-version: 2.13.3-r1

  - id: CGA-h8m3-hx96-fxpf
    aliases:
      - CVE-2025-23216
      - GHSA-47g2-qmh2-749v
    events:
      - timestamp: 2025-01-31T07:08:51Z
        type: fixed
        data:
          fixed-version: 2.13.4-r0

  - id: CGA-qmmh-7pp9-7h68
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-01-07T07:21:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 892ee794f182bbfd
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-01-07T14:42:16Z
        type: fixed
        data:
          fixed-version: 2.13.3-r1

  - id: CGA-v7rv-j84g-g5fj
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:09:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 0975cd8371881464
            componentName: golang.org/x/crypto
            componentVersion: v0.27.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-12-13T07:33:21Z
        type: fixed
        data:
          fixed-version: 2.13.2-r1