argo-rollouts.advisories.yaml

schema-version: 2.0.2

package:
  name: argo-rollouts

advisories:
  - id: CGA-4x3w-pm5j-g8x7
    aliases:
      - CVE-2024-51744
      - GHSA-29wx-vh33-7x7r
    events:
      - timestamp: 2024-11-05T08:06:27Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: fe3ac507749aa853
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.0
            componentType: go-module
            componentLocation: /usr/bin/rollouts-controller
            scanner: grype
      - timestamp: 2024-11-07T07:12:18Z
        type: fixed
        data:
          fixed-version: 1.7.2-r1

  - id: CGA-m9rp-87wr-xj88
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T16:45:24Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: a5dc50db9dd24a55
            componentName: golang.org/x/crypto
            componentVersion: v0.21.0
            componentType: go-module
            componentLocation: /usr/bin/rollouts-controller
            scanner: grype
      - timestamp: 2024-12-13T22:32:16Z
        type: fixed
        data:
          fixed-version: 1.7.2-r2

  - id: CGA-qqjm-hgqw-8v2c
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T07:16:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argo-rollouts
            componentID: cd6956faad16a4c2
            componentName: golang.org/x/net
            componentVersion: v0.25.0
            componentType: go-module
            componentLocation: /usr/bin/kubectl-argo-rollouts
            scanner: grype
      - timestamp: 2024-12-19T13:44:20Z
        type: fixed
        data:
          fixed-version: 1.7.2-r3