cert-manager-istio-csr.advisories.yaml

schema-version: 2.0.2

package:
  name: cert-manager-istio-csr

advisories:
  - id: CGA-5c45-prq2-g25c
    aliases:
      - GHSA-r4pg-vg54-wxx4
    events:
      - timestamp: 2024-11-21T07:02:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 23de4f064b96aab3
            componentName: github.com/cert-manager/cert-manager
            componentVersion: v1.15.3
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-11-22T10:28:10Z
        type: fixed
        data:
          fixed-version: 0.12.0-r1

  - id: CGA-6c94-vvvg-cv4v
    aliases:
      - CVE-2022-31045
      - GHSA-xwx5-5c9g-x68x
    events:
      - timestamp: 2024-11-18T12:00:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 89baf9e635c19868
            componentName: istio.io/istio
            componentVersion: v0.0.0-20240821191124-89d73dc1f639
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-11-21T12:09:03Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'The upstream project ignored the vulnerability since they import non-tagged versions in go.mod, for more information see: https://github.com/cert-manager/istio-csr/pull/344/files.'

  - id: CGA-c7qh-252v-jjrg
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:17:42Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: d9b3456ad91b5e0e
            componentName: golang.org/x/crypto
            componentVersion: v0.28.0
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-12-12T14:13:28Z
        type: fixed
        data:
          fixed-version: 0.13.0-r1

  - id: CGA-h284-r9mg-9p97
    aliases:
      - CVE-2019-14993
      - GHSA-qcvw-82hh-gq38
    events:
      - timestamp: 2024-11-18T12:00:56Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 89baf9e635c19868
            componentName: istio.io/istio
            componentVersion: v0.0.0-20240821191124-89d73dc1f639
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-11-21T12:09:08Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'The upstream project ignored the vulnerability since they import non-tagged versions in go.mod, for more information see: https://github.com/cert-manager/istio-csr/pull/344/files.'

  - id: CGA-jw75-prhc-9gq3
    aliases:
      - CVE-2021-39156
      - GHSA-hqxw-mm44-gc4r
    events:
      - timestamp: 2024-11-18T12:00:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 89baf9e635c19868
            componentName: istio.io/istio
            componentVersion: v0.0.0-20240821191124-89d73dc1f639
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-11-21T12:09:15Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'The upstream project ignored the vulnerability since they import non-tagged versions in go.mod, for more information see: https://github.com/cert-manager/istio-csr/pull/344/files.'

  - id: CGA-m24w-7f29-vfjq
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-20T07:22:49Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 7eea074db6939525
            componentName: golang.org/x/net
            componentVersion: v0.30.0
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-12-20T21:00:53Z
        type: fixed
        data:
          fixed-version: 0.13.0-r2

  - id: CGA-pw2v-5gqw-v996
    aliases:
      - CVE-2021-39155
      - GHSA-7774-7vr3-cc8j
    events:
      - timestamp: 2024-11-18T12:00:53Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 89baf9e635c19868
            componentName: istio.io/istio
            componentVersion: v0.0.0-20240821191124-89d73dc1f639
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-11-21T12:09:29Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'The upstream project ignored the vulnerability since they import non-tagged versions in go.mod, for more information see: https://github.com/cert-manager/istio-csr/pull/344/files.'

  - id: CGA-rhqc-632m-q62c
    aliases:
      - CVE-2022-23635
      - GHSA-856q-xv3c-7f2f
    events:
      - timestamp: 2024-11-18T12:00:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cert-manager-istio-csr
            componentID: 89baf9e635c19868
            componentName: istio.io/istio
            componentVersion: v0.0.0-20240821191124-89d73dc1f639
            componentType: go-module
            componentLocation: /usr/bin/cmd
            scanner: grype
      - timestamp: 2024-11-21T12:09:32Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'The upstream project ignored the vulnerability since they import non-tagged versions in go.mod, for more information see: https://github.com/cert-manager/istio-csr/pull/344/files.'