/
argo-workflows.advisories.yaml
170 lines (155 loc) · 4.28 KB
/
argo-workflows.advisories.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
schema-version: 2.0.2
package:
name: argo-workflows
advisories:
- id: CVE-2023-45283
aliases:
- GHSA-vvjp-q62m-2vph
events:
- timestamp: 2023-11-07T19:23:10Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows
- id: CVE-2023-45284
aliases:
- GHSA-rq3x-83w4-p28c
events:
- timestamp: 2023-11-07T19:23:12Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows
- id: CVE-2023-45288
aliases:
- GHSA-4v7x-pqxf-cx7m
events:
- timestamp: 2024-04-13T07:06:23Z
type: fixed
data:
fixed-version: 3.5.5-r5
- id: CVE-2023-46402
aliases:
- GHSA-3f2q-6294-fmq5
events:
- timestamp: 2023-12-03T14:31:33Z
type: fixed
data:
fixed-version: 3.5.2-r1
- id: CVE-2023-48795
aliases:
- GHSA-45x7-px36-x8w8
events:
- timestamp: 2023-12-19T16:57:10Z
type: fixed
data:
fixed-version: 3.5.2-r3
- id: CVE-2024-24557
aliases:
- GHSA-xw73-rw38-6vjc
events:
- timestamp: 2024-03-22T09:21:48Z
type: fixed
data:
fixed-version: 3.5.5-r4
- id: CVE-2024-24786
aliases:
- GHSA-8r3f-844c-mc37
events:
- timestamp: 2024-03-14T08:19:36Z
type: detection
data:
type: scan/v1
data:
subpackageName: argo-workflow-controller
componentID: f4b18383b61973ec
componentName: google.golang.org/protobuf
componentVersion: v1.31.0
componentType: go-module
componentLocation: /usr/bin/workflow-controller
scanner: grype
- timestamp: 2024-03-21T13:30:59Z
type: fixed
data:
fixed-version: 3.5.5-r4
- id: CVE-2024-27289
aliases:
- GHSA-m7wr-2xf7-cm9p
events:
- timestamp: 2024-03-13T07:05:45Z
type: detection
data:
type: scan/v1
data:
subpackageName: argo-workflows
componentID: e91e6517e2bfae1a
componentName: github.com/jackc/pgx/v4
componentVersion: v4.18.1
componentType: go-module
componentLocation: /usr/bin/argo
scanner: grype
- timestamp: 2024-03-13T15:43:39Z
type: fixed
data:
fixed-version: 3.5.5-r3
- id: CVE-2024-27304
aliases:
- GHSA-mrww-27vc-gghv
events:
- timestamp: 2024-03-15T09:11:13Z
type: fixed
data:
fixed-version: 3.5.5-r3
- id: CVE-2024-28180
aliases:
- GHSA-c5q2-7r4c-mv6g
events:
- timestamp: 2024-03-08T07:06:57Z
type: detection
data:
type: scan/v1
data:
subpackageName: argo-workflow-executor
componentID: d077f1b6fb924194
componentName: github.com/go-jose/go-jose/v3
componentVersion: v3.0.1
componentType: go-module
componentLocation: /usr/bin/argoexec
scanner: grype
- timestamp: 2024-03-08T22:56:16Z
type: fixed
data:
fixed-version: 3.5.5-r2
- id: GHSA-2c7c-3mj9-8fqh
events:
- timestamp: 2023-11-23T08:30:52Z
type: fixed
data:
fixed-version: 3.5.1-r1
- id: GHSA-7jwh-3vrq-q3m8
events:
- timestamp: 2024-03-15T09:11:15Z
type: fixed
data:
fixed-version: 3.5.5-r3
- id: GHSA-9763-4f94-gfch
events:
- timestamp: 2024-01-16T10:49:13Z
type: detection
data:
type: scan/v1
data:
subpackageName: argo-workflow-executor
componentID: 213e47f269f6a7ab
componentName: github.com/cloudflare/circl
componentVersion: v1.3.3
componentType: go-module
componentLocation: /usr/bin/argoexec
scanner: grype
- id: GHSA-jq35-85cj-fj4p
events:
- timestamp: 2023-10-31T20:03:40Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: This vulnerability is in the container runtime itself, not clients of the container runtime.