argo-events.advisories.yaml

schema-version: 2.0.2

package:
  name: argo-events

advisories:
  - id: CGA-3f4q-g4mj-3x9x
    aliases:
      - CVE-2024-6104
      - GHSA-v6v8-xj6m-xwqh
    events:
      - timestamp: 2024-09-06T15:24:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: a734d18a8ce28c7d
            componentName: github.com/hashicorp/go-retryablehttp
            componentVersion: v0.7.2
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-09-08T14:36:53Z
        type: fixed
        data:
          fixed-version: 1.9.2-r1

  - id: CGA-3w87-8f2f-gmcg
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T10:24:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: 2a63a7362b8f28b5
            componentName: golang.org/x/net
            componentVersion: v0.30.0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-12-19T18:05:01Z
        type: fixed
        data:
          fixed-version: 1.9.3-r2

  - id: CGA-4fww-c4xq-q3m5
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-01-07T07:01:56Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: 5d729e4c06be381d
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2025-01-07T14:06:45Z
        type: fixed
        data:
          fixed-version: 1.9.3-r3

  - id: CGA-562h-vqjm-ghfg
    aliases:
      - CVE-2024-35255
      - GHSA-m5vv-6r4h-3vj9
    events:
      - timestamp: 2024-09-06T15:24:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: "2905762031361718"
            componentName: github.com/Azure/azure-sdk-for-go/sdk/azidentity
            componentVersion: v1.5.2
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-09-08T14:36:54Z
        type: fixed
        data:
          fixed-version: 1.9.2-r1

  - id: CGA-87mm-7cv7-9jrw
    aliases:
      - CVE-2023-46402
      - GHSA-3f2q-6294-fmq5
    events:
      - timestamp: 2024-09-06T15:24:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: 6fe962df09571769
            componentName: github.com/whilp/git-urls
            componentVersion: v0.0.0-20191001220047-6db9661140c0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-09-08T14:36:53Z
        type: fixed
        data:
          fixed-version: 1.9.2-r1

  - id: CGA-fr99-mq7x-jpqh
    aliases:
      - CVE-2024-51744
      - GHSA-29wx-vh33-7x7r
    events:
      - timestamp: 2024-11-05T08:28:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: b5fe8e9479714a00
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-11-05T11:39:59Z
        type: fixed
        data:
          fixed-version: 1.9.2-r2

  - id: CGA-m8c4-v4hm-5fgg
    aliases:
      - CVE-2023-37475
      - GHSA-9x44-9pgq-cf45
    events:
      - timestamp: 2024-09-06T15:24:56Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: b8c3a50b89ca2606
            componentName: github.com/hamba/avro
            componentVersion: v1.8.0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-09-08T14:36:54Z
        type: fixed
        data:
          fixed-version: 1.9.2-r1

  - id: CGA-pjf8-phcp-8c4r
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-01-07T07:01:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: 5d729e4c06be381d
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.12.0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2025-01-07T14:06:44Z
        type: fixed
        data:
          fixed-version: 1.9.3-r3

  - id: CGA-vh6q-382j-gphg
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:07:39Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-events
            componentID: bc7d58d04d71a98f
            componentName: golang.org/x/crypto
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /usr/bin/argo-events
            scanner: grype
      - timestamp: 2024-12-12T11:29:07Z
        type: fixed
        data:
          fixed-version: 1.9.3-r1