Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revert "drop advisories" #2470

Merged
merged 1 commit into from Mar 13, 2024
Merged

Revert "drop advisories" #2470

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
167 changes: 167 additions & 0 deletions argo-cd-2.8.advisories.yaml
View file
Open in desktop
@@ -0,0 +1,167 @@
schema-version: 2.0.2

package:
name: argo-cd-2.8

advisories:
- id: CVE-2020-8552
aliases:
- GHSA-82hx-w2r5-c2wq
events:
- timestamp: 2023-09-19T16:39:16Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Go vulndb has marked this code NOT_IMPORTABLE.

- id: CVE-2021-25743
aliases:
- GHSA-f9jg-8p32-2f55
events:
- timestamp: 2023-10-03T20:09:07Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: The vulnerable code is specific to kubectl.

- id: CVE-2023-39325
aliases:
- GHSA-4374-p667-p6c8
events:
- timestamp: 2023-10-13T12:39:00Z
type: fixed
data:
fixed-version: 2.8.4-r4

- id: CVE-2023-3955
aliases:
- GHSA-q78c-gwqw-jcmc
events:
- timestamp: 2023-11-02T13:04:14Z
type: fixed
data:
fixed-version: 2.8.6-r1

- id: CVE-2023-3978
aliases:
- GHSA-2wrh-6pvc-2jm9
events:
- timestamp: 2023-10-13T12:38:14Z
type: fixed
data:
fixed-version: 2.8.4-r4

- id: CVE-2023-45283
aliases:
- GHSA-vvjp-q62m-2vph
events:
- timestamp: 2023-11-07T19:23:07Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows

- id: CVE-2023-45284
aliases:
- GHSA-rq3x-83w4-p28c
events:
- timestamp: 2023-11-07T19:23:08Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows

- id: CVE-2023-46402
aliases:
- GHSA-3f2q-6294-fmq5
events:
- timestamp: 2023-12-03T14:31:22Z
type: fixed
data:
fixed-version: 2.8.7-r2

- id: CVE-2023-47108
aliases:
- GHSA-8pgv-569h-w5rw
events:
- timestamp: 2023-11-20T11:56:44Z
type: fixed
data:
fixed-version: 2.8.6-r2

- id: CVE-2023-48795
aliases:
- GHSA-45x7-px36-x8w8
events:
- timestamp: 2023-12-19T18:22:00Z
type: fixed
data:
fixed-version: 2.8.7-r5

- id: CVE-2023-49568
aliases:
- GHSA-mw99-9chc-xw7r
events:
- timestamp: 2023-12-28T17:54:50Z
type: fixed
data:
fixed-version: 2.8.7-r6

- id: CVE-2023-5528
aliases:
- GHSA-hq6q-c2x6-hmch
events:
- timestamp: 2023-11-20T12:06:42Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: This vulnerability affects the Kubernetes application, not the golang k8s.io/kubernetes library. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

- id: GHSA-2c7c-3mj9-8fqh
events:
- timestamp: 2023-11-23T08:30:26Z
type: fixed
data:
fixed-version: 2.8.7-r1

- id: GHSA-6xv5-86q9-7xr8
events:
- timestamp: 2023-09-09T15:18:00Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: This vulnerability is only present on Windows.

- id: GHSA-9763-4f94-gfch
events:
- timestamp: 2024-01-11T07:08:25Z
type: detection
data:
type: scan/v1
data:
subpackageName: argo-cd-2.8-compat
componentID: c44db37d9765f6ee
componentName: github.com/cloudflare/circl
componentVersion: v1.3.3
componentType: go-module
componentLocation: /usr/local/bin/argocd
scanner: grype

- id: GHSA-c5q2-7r4c-mv6g
events:
- timestamp: 2024-03-08T07:07:44Z
type: detection
data:
type: scan/v1
data:
subpackageName: argo-cd-2.8
componentID: 01bb87cfc9651e9f
componentName: github.com/go-jose/go-jose/v3
componentVersion: v3.0.1
componentType: go-module
componentLocation: /usr/bin/argocd
scanner: grype
- timestamp: 2024-03-08T20:39:07Z
type: fixed
data:
fixed-version: 2.8.10-r2
89 changes: 89 additions & 0 deletions cluster-autoscaler-1.26.advisories.yaml
View file
Open in desktop
@@ -0,0 +1,89 @@
schema-version: 2.0.2

package:
name: cluster-autoscaler-1.26

advisories:
- id: CVE-2023-39325
aliases:
- GHSA-4374-p667-p6c8
events:
- timestamp: 2023-10-25T17:23:00Z
type: fixed
data:
fixed-version: 1.26.4-r3

- id: CVE-2023-3955
aliases:
- GHSA-q78c-gwqw-jcmc
events:
- timestamp: 2023-11-02T14:44:46Z
type: fixed
data:
fixed-version: 1.26.4-r4

- id: CVE-2023-3978
aliases:
- GHSA-2wrh-6pvc-2jm9
events:
- timestamp: 2023-10-25T17:22:43Z
type: fixed
data:
fixed-version: 1.26.4-r3

- id: CVE-2023-44487
aliases:
- GHSA-qppj-fm5r-hxr3
- GHSA-m425-mq94-257g
events:
- timestamp: 2023-10-25T17:23:15Z
type: fixed
data:
fixed-version: 1.26.4-r4

- id: CVE-2023-45142
aliases:
- GHSA-rcjv-mgp8-qvmr
events:
- timestamp: 2023-10-25T15:18:52Z
type: true-positive-determination
data:
note: Govulncheck confirms the affect symbol is present. But bumping the affected dependency requires third party modules to update their code not to use packages removed in recent versions of OpenTelemtry's modules, so we'll need to wait for upstream changes to fix this.

- id: CVE-2023-45283
aliases:
- GHSA-vvjp-q62m-2vph
events:
- timestamp: 2023-11-07T19:24:32Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows

- id: CVE-2023-45284
aliases:
- GHSA-rq3x-83w4-p28c
events:
- timestamp: 2023-11-07T19:24:34Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows

- id: CVE-2023-48795
aliases:
- GHSA-45x7-px36-x8w8
events:
- timestamp: 2024-02-16T07:02:17Z
type: fixed
data:
fixed-version: 1.26.6-r1

- id: CVE-2023-5528
aliases:
- GHSA-hq6q-c2x6-hmch
events:
- timestamp: 2023-11-22T09:21:38Z
type: fixed
data:
fixed-version: 1.26.4-r5
89 changes: 89 additions & 0 deletions cluster-autoscaler-1.27.advisories.yaml
View file
Open in desktop
@@ -0,0 +1,89 @@
schema-version: 2.0.2

package:
name: cluster-autoscaler-1.27

advisories:
- id: CVE-2023-39325
aliases:
- GHSA-4374-p667-p6c8
events:
- timestamp: 2023-10-25T15:16:11Z
type: fixed
data:
fixed-version: 1.27.3-r5

- id: CVE-2023-3955
aliases:
- GHSA-q78c-gwqw-jcmc
events:
- timestamp: 2023-11-02T14:46:57Z
type: fixed
data:
fixed-version: 1.27.3-r6

- id: CVE-2023-3978
aliases:
- GHSA-2wrh-6pvc-2jm9
events:
- timestamp: 2023-10-25T15:15:54Z
type: fixed
data:
fixed-version: 1.27.3-r5

- id: CVE-2023-44487
aliases:
- GHSA-qppj-fm5r-hxr3
- GHSA-m425-mq94-257g
events:
- timestamp: 2023-10-25T15:16:27Z
type: fixed
data:
fixed-version: 1.27.3-r6

- id: CVE-2023-45142
aliases:
- GHSA-rcjv-mgp8-qvmr
events:
- timestamp: 2023-10-25T14:21:21Z
type: true-positive-determination
data:
note: Govulncheck confirms the affect symbol is present. But bumping the affected dependency requires third party modules to update their code not to use packages removed in recent versions of OpenTelemtry's modules, so we'll need to wait for upstream changes to fix this.

- id: CVE-2023-45283
aliases:
- GHSA-vvjp-q62m-2vph
events:
- timestamp: 2023-11-07T19:24:36Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows

- id: CVE-2023-45284
aliases:
- GHSA-rq3x-83w4-p28c
events:
- timestamp: 2023-11-07T19:24:37Z
type: false-positive-determination
data:
type: vulnerable-code-not-included-in-package
note: Only affects Windows

- id: CVE-2023-48795
aliases:
- GHSA-45x7-px36-x8w8
events:
- timestamp: 2024-02-15T07:26:05Z
type: fixed
data:
fixed-version: 1.27.5-r1

- id: CVE-2023-5528
aliases:
- GHSA-hq6q-c2x6-hmch
events:
- timestamp: 2023-11-22T09:36:01Z
type: fixed
data:
fixed-version: 1.27.3-r7