argo-rollouts.advisories.yaml

schema-version: 2.0.2

package:
  name: argo-rollouts

advisories:
  - id: CGA-4x3w-pm5j-g8x7
    aliases:
      - CVE-2024-51744
      - GHSA-29wx-vh33-7x7r
    events:
      - timestamp: 2024-11-05T08:06:27Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: fe3ac507749aa853
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.0
            componentType: go-module
            componentLocation: /usr/bin/rollouts-controller
            scanner: grype
      - timestamp: 2024-11-07T07:12:18Z
        type: fixed
        data:
          fixed-version: 1.7.2-r1

  - id: CGA-6mgv-3w46-mv3w
    aliases:
      - CVE-2024-45336
      - GHSA-7wrw-r4p8-38rx
    events:
      - timestamp: 2025-01-31T07:08:08Z
        type: fixed
        data:
          fixed-version: 1.7.2-r4

  - id: CGA-f8h3-38xx-32ff
    aliases:
      - CVE-2024-45341
      - GHSA-3f6r-qh9c-x6mm
    events:
      - timestamp: 2025-01-31T07:08:09Z
        type: fixed
        data:
          fixed-version: 1.7.2-r4

  - id: CGA-m9rp-87wr-xj88
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T16:45:24Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: a5dc50db9dd24a55
            componentName: golang.org/x/crypto
            componentVersion: v0.21.0
            componentType: go-module
            componentLocation: /usr/bin/rollouts-controller
            scanner: grype
      - timestamp: 2024-12-13T22:32:16Z
        type: fixed
        data:
          fixed-version: 1.7.2-r2

  - id: CGA-qqjm-hgqw-8v2c
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T07:16:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: cd6956faad16a4c2
            componentName: golang.org/x/net
            componentVersion: v0.25.0
            componentType: go-module
            componentLocation: /usr/bin/kubectl-argo-rollouts
            scanner: grype
      - timestamp: 2024-12-19T13:44:20Z
        type: fixed
        data:
          fixed-version: 1.7.2-r3

  - id: CGA-vx3x-3442-f593
    aliases:
      - GHSA-29qp-crvh-w22m
    events:
      - timestamp: 2025-01-31T07:04:30Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: ff7d645c95dff5e5
            componentName: github.com/hashicorp/yamux
            componentVersion: v0.1.1
            componentType: go-module
            componentLocation: /usr/bin/kubectl-argo-rollouts
            scanner: grype
      - timestamp: 2025-01-31T18:14:03Z
        type: true-positive-determination
        data:
          note: "Awaiting release of fix by upstream dependency yamux: https://github.com/hashicorp/yamux/pull/143"