argo-cd-2.13.advisories.yaml

schema-version: 2.0.2

package:
  name: argo-cd-2.13

advisories:
  - id: CGA-7xh8-794m-627j
    aliases:
      - CVE-2024-35255
      - GHSA-m5vv-6r4h-3vj9
    events:
      - timestamp: 2024-11-06T09:03:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13-repo-server
            componentID: 8c834c4ead047f14
            componentName: github.com/Azure/azure-sdk-for-go/sdk/azidentity
            componentVersion: v1.1.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-11-18T20:03:39Z
        type: fixed
        data:
          fixed-version: 2.13.0-r1

  - id: CGA-875c-5xx8-qwjf
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T21:12:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 0b45878c6faef543
            componentName: golang.org/x/net
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /usr/bin/argocd
            scanner: grype
      - timestamp: 2024-12-20T15:32:32Z
        type: fixed
        data:
          fixed-version: 2.13.2-r2

  - id: CGA-gc77-5phf-vxm8
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-01-07T07:21:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 892ee794f182bbfd
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-01-07T14:42:16Z
        type: fixed
        data:
          fixed-version: 2.13.3-r1

  - id: CGA-qmmh-7pp9-7h68
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-01-07T07:21:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 892ee794f182bbfd
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2025-01-07T14:42:16Z
        type: fixed
        data:
          fixed-version: 2.13.3-r1

  - id: CGA-v7rv-j84g-g5fj
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:09:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-cd-2.13
            componentID: 0975cd8371881464
            componentName: golang.org/x/crypto
            componentVersion: v0.27.0
            componentType: go-module
            componentLocation: /usr/local/bin/argocd
            scanner: grype
      - timestamp: 2024-12-13T07:33:21Z
        type: fixed
        data:
          fixed-version: 2.13.2-r1