argocd-image-updater.advisories.yaml

schema-version: 2.0.2

package:
  name: argocd-image-updater

advisories:
  - id: CGA-3gr6-qqw3-rph3
    aliases:
      - CVE-2025-47907
      - GHSA-j5pm-7495-qmr3
    events:
      - timestamp: 2025-08-09T10:31:51Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: f66e5c757fb83f1b
            componentName: stdlib
            componentVersion: go1.24.5
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-08-09T17:33:13Z
        type: fixed
        data:
          fixed-version: 0.16.0-r6

  - id: CGA-4vxc-2qw8-5v4q
    aliases:
      - CVE-2025-21614
      - GHSA-r9px-m959-cxf4
    events:
      - timestamp: 2025-01-07T08:01:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: ced0df49e781e516
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.11.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-01-10T22:37:18Z
        type: fixed
        data:
          fixed-version: 0.15.2-r1

  - id: CGA-5prg-fc3x-7vrg
    aliases:
      - CVE-2023-2253
      - GHSA-hqxw-f8mx-cpmw
    events:
      - timestamp: 2024-12-16T09:44:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: f6b503101cd0c1bb
            componentName: github.com/docker/distribution
            componentVersion: v2.8.1+incompatible
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2024-12-19T01:41:09Z
        type: pending-upstream-fix
        data:
          note: This CVE is caused by a 'go replace' block in the go.mod file pulling in the dependency, despite the package using the latest version as defined elsewhere in the go.mod file. An upstream patch has been submitted and merged which will remove this old dependency in future versions. See https://github.com/argoproj-labs/argocd-image-updater/pull/969

  - id: CGA-5rp6-4mjh-x223
    aliases:
      - CVE-2025-61729
      - GHSA-7c64-f9jr-v9h2
    events:
      - timestamp: 2025-12-04T12:17:06Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: a1e03160b2cc91e3
            componentName: stdlib
            componentVersion: go1.25.4
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-12-04T17:13:53Z
        type: fixed
        data:
          fixed-version: 1.0.1-r2

  - id: CGA-6384-59f2-hwmg
    aliases:
      - CVE-2025-47914
      - GHSA-f6x5-jh6r-wrfv
    events:
      - timestamp: 2025-11-21T07:40:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 6690360033b4d5d8
            componentName: golang.org/x/crypto
            componentVersion: v0.43.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-11-21T08:58:29Z
        type: fixed
        data:
          fixed-version: 1.0.1-r1

  - id: CGA-74w6-9rf4-9jcv
    aliases:
      - CVE-2024-9042
      - GHSA-vv39-3w5q-974q
    events:
      - timestamp: 2025-03-14T18:19:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: ce0ace030aa44c43
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-03-16T17:49:31Z
        type: pending-upstream-fix
        data:
          note: Upstream able to bump to k8s deps to v0.30.x on master branch already, but v0.15.2 tag uses v0.26.x versions and makes impossible to bump k8s dependency to v1.31.5. Next release will hopefully mitigate the CVE.
      - timestamp: 2025-03-19T14:09:48Z
        type: false-positive-determination
        data:
          type: vulnerable-code-cannot-be-controlled-by-adversary
          note: This vulnerability affects versions <= v1.29.12. This vulnerability is limited to Windows hosts.

  - id: CGA-7f5p-rw78-6c4h
    aliases:
      - CVE-2025-22870
      - GHSA-qxp5-gwg8-xv66
    events:
      - timestamp: 2025-03-13T23:13:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: e0304b2d84cd2266
            componentName: golang.org/x/net
            componentVersion: v0.33.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-03-15T03:23:18Z
        type: fixed
        data:
          fixed-version: 0.15.2-r8

  - id: CGA-7q65-c6rc-w43m
    aliases:
      - CVE-2025-22872
      - GHSA-vvgc-356p-c3xw
    events:
      - timestamp: 2025-04-17T07:08:06Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: e128abf8e57d472d
            componentName: golang.org/x/net
            componentVersion: v0.36.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-04-17T09:05:36Z
        type: fixed
        data:
          fixed-version: 0.16.0-r2

  - id: CGA-8f2g-mfp5-w93h
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T12:16:28Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: bb3b35edacb0c7e0
            componentName: golang.org/x/net
            componentVersion: v0.28.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2024-12-20T01:06:21Z
        type: fixed
        data:
          fixed-version: 0.15.1-r1

  - id: CGA-8jqf-m7w3-vp9j
    aliases:
      - CVE-2025-21613
      - GHSA-v725-9546-7q7m
    events:
      - timestamp: 2025-01-07T08:01:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: ced0df49e781e516
            componentName: github.com/go-git/go-git/v5
            componentVersion: v5.11.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-01-10T22:37:18Z
        type: fixed
        data:
          fixed-version: 0.15.2-r1

  - id: CGA-9wrh-9q26-hm24
    aliases:
      - GHSA-274v-mgcv-cm8j
    events:
      - timestamp: 2025-01-31T07:02:43Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 4f70adb273eb64a0
            componentName: github.com/argoproj/gitops-engine
            componentVersion: v0.7.1-0.20240715141605-18ba62e1f1fb
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-02-03T22:59:28Z
        type: pending-upstream-fix
        data:
          note: The gitops-engine@v0.7.3 has breaking changes, upstream maintainers will have to address required changes from version v0.7.1-0.20250129155113-faf5a4e5c37d.'

  - id: CGA-c2ww-q9hx-2x89
    aliases:
      - GHSA-2x5j-vhc8-9cwm
    events:
      - timestamp: 2025-06-11T07:11:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: a1c808053e934095
            componentName: github.com/cloudflare/circl
            componentVersion: v1.3.7
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-06-11T08:36:16Z
        type: true-positive-determination
        data:
          note: Unable to use govulncheck to triage this advisory because the vulnerability was not found in the Go vuln DB. Treating as a true positive since we can't confirm this is a false positive.
      - timestamp: 2025-06-11T08:54:15Z
        type: fixed
        data:
          fixed-version: 0.16.0-r4

  - id: CGA-c48m-jpph-r4pg
    aliases:
      - CVE-2025-47933
      - GHSA-2hj5-g64g-fp6p
    events:
      - timestamp: 2025-05-29T07:14:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: ce24f28c24147e83
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.13.5
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-05-29T14:03:18Z
        type: true-positive-determination
        data:
          note: Unable to use govulncheck to triage this advisory because the vulnerability was not found in the Go vuln DB. Treating as a true positive since we can't confirm this is a false positive.
      - timestamp: 2025-05-29T14:05:25Z
        type: fixed
        data:
          fixed-version: 0.16.0-r3

  - id: CGA-cjr4-f6q7-9mh7
    aliases:
      - CVE-2024-0793
      - GHSA-h7wq-jj8r-qm7p
    events:
      - timestamp: 2024-12-16T09:44:15Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 9558a962455517a8
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-01-10T20:09:22Z
        type: pending-upstream-fix
        data:
          note: Attempting to patch this CVE via updating the affected module leads to resolution errors with other modules, therefore a patch from upstream is required to remediate this CVE.

  - id: CGA-fg49-xw36-gj5x
    aliases:
      - CVE-2025-55190
      - GHSA-786q-9hcg-v9ff
    events:
      - timestamp: 2025-09-06T07:12:30Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: e4c4f378dbea5272
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.13.8
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-09-06T08:30:53Z
        type: fixed
        data:
          fixed-version: 0.16.0-r8

  - id: CGA-fghq-cmj5-4jgc
    aliases:
      - CVE-2024-5321
      - GHSA-82m2-cv7p-4m75
    events:
      - timestamp: 2024-12-16T09:44:14Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 9558a962455517a8
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-01-10T20:09:31Z
        type: pending-upstream-fix
        data:
          note: Attempting to patch this CVE via updating the affected module leads to resolution errors with other modules, therefore a patch from upstream is required to remediate this CVE.

  - id: CGA-fh8w-q8mm-chgc
    aliases:
      - CVE-2025-22868
    events:
      - timestamp: 2025-03-06T06:35:53Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 23cf27524ff74272
            componentName: golang.org/x/oauth2
            componentVersion: v0.22.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-03-12T21:38:15Z
        type: fixed
        data:
          fixed-version: 0.15.2-r7

  - id: CGA-fq6v-35jw-2v79
    aliases:
      - CVE-2025-30204
      - GHSA-mh63-6h87-95cp
    events:
      - timestamp: 2025-03-22T07:09:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: c50fc6809e086766
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.1
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-03-22T10:26:24Z
        type: fixed
        data:
          fixed-version: 0.15.2-r9

  - id: CGA-fwr5-m8r5-xwrq
    aliases:
      - CVE-2025-1767
      - GHSA-3wgm-2gw2-vh5m
    events:
      - timestamp: 2025-03-15T07:03:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: ce0ace030aa44c43
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-03-18T01:32:23Z
        type: pending-upstream-fix
        data:
          note: 'The k8s.io CVE affecting this package is currently in the triage stage upstream, PR on the issue can be found here: https://github.com/kubernetes/kubernetes/issues/130786'
      - timestamp: 2025-04-06T22:29:42Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: This vulnerability applies to the git-repo volume provisioner, not the k8s client itself.

  - id: CGA-hmq5-6458-rg5f
    aliases:
      - CVE-2025-58181
      - GHSA-j5w8-q4qc-rx2x
    events:
      - timestamp: 2025-11-21T07:40:23Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 6690360033b4d5d8
            componentName: golang.org/x/crypto
            componentVersion: v0.43.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-11-21T08:58:30Z
        type: fixed
        data:
          fixed-version: 1.0.1-r1

  - id: CGA-hrx6-hvq8-xj45
    aliases:
      - CVE-2024-3177
      - GHSA-pxhw-596r-rwq5
    events:
      - timestamp: 2024-12-16T09:44:18Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 9558a962455517a8
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-01-10T20:07:00Z
        type: pending-upstream-fix
        data:
          note: Attempting to patch this CVE via updating the affected module leads to resolution errors with other modules, therefore a patch from upstream is required to remediate this CVE.

  - id: CGA-j77v-32j2-gjrr
    aliases:
      - CVE-2025-22866
      - GHSA-3whm-j4xm-rv8x
    events:
      - timestamp: 2025-02-08T15:39:14Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: faa611185b3088d0
            componentName: stdlib
            componentVersion: go1.23.5
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-02-09T04:19:26Z
        type: fixed
        data:
          fixed-version: 0.15.2-r4

  - id: CGA-pv28-fqqh-4xj7
    aliases:
      - CVE-2024-10220
      - GHSA-27wf-5967-98gx
    events:
      - timestamp: 2024-12-16T09:44:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 9558a962455517a8
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2024-12-19T02:15:53Z
        type: pending-upstream-fix
        data:
          note: 'Attempting to patch this CVE via updating the affected module leads to resolution errors with other modules, therefore a patch from upstream is required to remediate this CVE. '

  - id: CGA-r75w-886h-wmv4
    aliases:
      - CVE-2025-22869
    events:
      - timestamp: 2025-03-06T06:35:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: f74ea55d4cb538bc
            componentName: golang.org/x/crypto
            componentVersion: v0.31.0
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-03-22T05:02:54Z
        type: fixed
        data:
          fixed-version: 0.15.2-r8

  - id: CGA-v8g2-44h4-3cqw
    aliases:
      - CVE-2025-27144
      - GHSA-c6gw-w398-hv78
    events:
      - timestamp: 2025-02-27T07:20:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 5c447a1c0f2681e1
            componentName: github.com/go-jose/go-jose/v3
            componentVersion: v3.0.3
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-02-27T12:21:27Z
        type: fixed
        data:
          fixed-version: 0.15.2-r5

  - id: CGA-x7mp-c57f-mxrr
    aliases:
      - CVE-2025-0426
      - GHSA-jgfp-53c3-624w
    events:
      - timestamp: 2025-02-14T07:09:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: b518066403b8352b
            componentName: k8s.io/kubernetes
            componentVersion: v1.26.11
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-02-20T19:53:17Z
        type: pending-upstream-fix
        data:
          note: Attempting to patch this CVE via updating the affected module leads to resolution errors with other modules, therefore a patch from upstream is required to remediate this CVE.

  - id: CGA-x7rr-c627-cq3q
    aliases:
      - CVE-2025-13281
      - GHSA-r6j8-c6r2-37rr
    events:
      - timestamp: 2025-12-17T19:07:09Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: a5d0ea3cbaa090c8
            componentName: k8s.io/kubernetes
            componentVersion: v1.33.4
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-12-17T23:56:37Z
        type: fixed
        data:
          fixed-version: 1.0.2-r1

  - id: CGA-xfc5-jrg3-q4px
    aliases:
      - CVE-2025-23216
      - GHSA-47g2-qmh2-749v
    events:
      - timestamp: 2025-01-31T07:02:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: argocd-image-updater
            componentID: 63dcc201d25d463a
            componentName: github.com/argoproj/argo-cd/v2
            componentVersion: v2.11.7
            componentType: go-module
            componentLocation: /usr/bin/argocd-image-updater
            scanner: grype
      - timestamp: 2025-01-31T18:21:43Z
        type: fixed
        data:
          fixed-version: 0.15.2-r3