diff --git a/USERS.md b/USERS.md index 8b3130548f247..ef200ecb3a362 100644 --- a/USERS.md +++ b/USERS.md @@ -335,6 +335,7 @@ Currently, the following organizations are **officially** using Argo CD: 1. [Swisscom](https://www.swisscom.ch) 1. [Swissquote](https://github.com/swissquote) 1. [Syncier](https://syncier.com/) +1. [Synergy](https://synergy.net.au) 1. [Syself](https://syself.com) 1. [TableCheck](https://tablecheck.com/) 1. [Tailor Brands](https://www.tailorbrands.com) diff --git a/docs/proposals/manifest-hydrator.md b/docs/proposals/manifest-hydrator.md new file mode 100644 index 0000000000000..313c92adb78de --- /dev/null +++ b/docs/proposals/manifest-hydrator.md @@ -0,0 +1,538 @@ +--- +title: Manifest Hydrator +authors: + - "@crenshaw-dev" + - "@zachaller" +sponsors: + - TBD # List all interested parties here. +reviewers: + - TBD +approvers: + - TBD + +creation-date: 2024-03-26 +last-updated: 2024-03-26 +--- + +# Manifest Hydrator + +This proposal describes a feature to make manifest hydration (i.e. the "rendered manifest pattern") a first-class feature of Argo CD. + +## Terms + +* dry manifests: DRY or Don't Repeat Yourself - things like Kustomize overlays and Helm charts that produce Kubernetes manifests but are not themselves Kubernetes Manifests +* hydrated manifests: the output from dry manifest tools, i.e. plain Kubernetes manifests + +## Summary + +Manifest hydration tools like Helm and Kustomize are indispensable in GitOps. These tools transform "dry" (Don't Repeat Yourself) sources into plain Kubernetes manifests. The effects of a change to dry sources are not always obvious. So storing only dry sources in git leaves the user with an incomplete and confusing history of their application. This undercuts some of the main benefits of GitOps. + +The "rendered manifests" pattern has emerged as a way to mitigate the downsides of using hydration tools in GitOps. Today, developers use CI tools to automatically hydrate manifests and push to separate branches. They then configure Argo CD to deploy from the hydrated branches. (For more information, see the awesome [blog post](https://akuity.io/blog/the-rendered-manifests-pattern/) and [ArgoCon talk](https://www.youtube.com/watch?v=TonN-369Qfo) by Nicholas Morey.) + +This proposal describes manifest hydration and pushing to git as a first-class feature of Argo CD. + +It offers two modes of operation: push-to-deploy and push-to-stage. In push-to-deploy, hydrated manifests are pushed to the same branch from which Argo CD deploys. In push-to-stage, manifests are pushed to a different branch, and Argo CD relies on some external system to move changes to the deployment branch; this provides an integration point for automated environment promotion systems. + +### Opinions + +This proposal is opinionated. It is based on the belief that, in order to reap the full benefits of GitOps, every change to an application's desired state must originate from a commit to a single GitOps repository. In other words, the full history of the application's desired state must be visible as the commit history on a git repository. + +This requirement is incompatible with tooling which injects nondeterministic configuration into the desired state before it is deployed by the GitOps controller. Examples of nondeterministic external configuration are: + +1) Helm chart dependencies on unpinned chart versions +2) Kustomize remote bases to unpinned git revisions +3) Config tool parameter overrides in the Argo CD Application `spec.source` fields +4) Multiple sources referenced in the same application (knowledge of combination of source versions is held externally to git) + +Injecting nondeterministic configuration makes it impossible to know the complete history of an application by looking at a git branch history. Even if the nondeterministic output is databased (for example, in a hydrated source branch in git), it is impossible for developers to confidently make changes to desired state, because they cannot know ahead of time what other configuration will be injected at deploy time. + +We believe that the problems of injecting external configuration are best solved by asking these two questions: + +1) Does the configuration belong in the developer's interface (i.e. the dry manifests)? +2) Does the configuration need to be mutable at runtime, or only at deploy time? + +If the configuration belongs in the developer's interface, write a tool to push the information to git. Image tags are a good example of such configuration, and the Argo CD Image Updater is a good example of such tooling. + +If the configuration doesn't belong in the developer's interface, and it needs to be updated at runtime, write a controller. The developer shouldn't be expected to maintain configuration which is not an immediate part of their desired state. An example would be an auto-sizing controller which eliminates the need for the developer to manage their own autoscaler config. + +If the configuration doesn't belong in the developer's interface and doesn't need to be updated at runtime (only at deploy time), write a mutating webhook. This is a great option for injecting cluster-specific configuration that the developer doesn't need to directly control. + +With these three options available (git-pushers, controllers, and mutating webhooks), we believe that it is not generally necessary to inject nondeterministic configuration into the manifest hydration process. Instead, we can have a full history of the developer's minimal intent (dry branch) and the full expression of that intent (hydrated branch) completely recorded in a series of commits on a git branch. + +By respecting these limitations, we unlock the ability to manage change promotion/reversion entirely via git. Change lineage is fully represented as a series of dry commit hashes. This makes it possible to write reliable rules around how these hashes are promoted to different environments and how they are reverted (i.e. we can meaningfully say "`prod` may never be more than one dry hash ahead of `test`"). If information about the lineage of an application is scattered among multiple sources, it is difficult or even impossible to meaningfully define rules about how one environment's lineage must relate to that of another environment. + +Being opinionated unlocks the full benefits of GitOps as well as the ability to build a reasonable, reliable preview/promotion/reversion system. + +These opinions will lock out use cases where configuration injection cannot be avoided by writing git-pushers, controllers, or mutating webhooks. We believe that the benefits of making an opinionated system outweigh the costs of compromising those opinions. + +## Motivation + +Many organizations have implemented their own manifest hydration system. By implementing it in Argo CD, we can lower the cost to our users of maintaining those systems, and we can encourage best practices related to the pattern. + +### Goals + +1) Make manifest hydration easy and intuitive for Argo CD users +2) Make it possible to implement a promotion system which relies on the manifest hydration's push-to-stage mode +3) Emphasize maintaining as much of the system's state as possible in git rather than in the Application CR (e.g. source hydrator config values, such as Helm values) +4) Every deployed change must have a corresponding dry commit - i.e. git is always the source of any changes +5) Developers should be able to easily reproduce the manifest hydration process locally, i.e. by running some commands + +#### Hydration Reproducibility + +One goal of this proposal is to make hydration reproducibility easy. Reproducibility brings a couple benefits: easy iteration/debugging and reliable previews. + +##### Easy Iteration/Debugging + +The hydration system should enable developers to easily reproduce the hydration process locally. The developer should be able to run a short series of commands and perform the exact same tasks that Argo CD would take to hydrate their manifests. This allows the developer to verify that Argo CD is behaving as expected and to quickly tweak inputs and see the results. This lets them iterate quickly and improves developer satisfaction and change velocity. + +To provide this experience, the hydrator needs to provide the developer with a few pieces of information: + +1) The input repo URL, path, and commit SHA +2) The hydration tool CLI version(s) (for example, the version of the Helm CLI used for hydration) +3) A series of commands and arguments which the developer can run locally + +Equipped with this information, the developer can perform the exact same steps as Argo CD and be confident that their dry manifest changes will produce the desired output. + +Ensuring that hydration is deterministic assures the developer that the output for a given dry state will be the same next week as it is today. + +###### Avoiding Esoteric Behavior + +We should avoid the developer needing to know Argo CD-specific behavior in order to reproduce hydration. Tools like Helm, Kustimize, etc. have excellent public-facing documentation which the developer should be able to take advantage of without needing to know quirks of Argo CD. + +##### Reliable Previews + +Deterministic hydration output allows Argo CD to produce a reliable change preview when a developer proposes a change to the dry manifests via a PR. + +If output is not deterministic, then a preview generated today might not be valid/correct a week, day, or even hour later. Non-determinism makes it so that developers can't trust that the change they review will be the change actually applied. + +### Non-Goals + +1) Implementing a change promotion system + +## Open Questions + +* The `sourceHydrator` field is mutually exclusive with the `source` and the `sources` field. Should we throw an error if they're both configured, or should we just pick one and ignore the others? +* How will/should this feature relate to the image updater? Is there an opportunity to share code, since both tools involve pushing to git? +* Should we enforce a naming convention for hydrated manifest branches, e.g. `argo/...`? This would make it easier to recommend branch protection rules, for example, only allow pushes to `argo/*` from the argo bot. +* Should we enforce setting a `sourceHydrator.syncSource.path` to something besides `.`? Setting a path makes it easier to add/remove other apps later if desired. + +## Proposal + +Today, Argo CD watches one or more git repositories (configured in the `spec.source` or `spec.sources` field). When a new commit appears, Argo CD updates the desired state by rendering the manifests with the configured manifest hydration tool. If auto-sync is enabled, Argo CD applies the new manifests to the cluster. + +With the introduction of this change, Argo CD will watch two revisions in the same git repository: the first is the "dry source", i.e. the git repo/revision where the un-rendered manifests reside, and the second is the "hydrated source," where the rendered manifests are places and retrieved for syncing to the cluster. + +### New `spec.sourceHydrator` Application Field + +A `sourceHydrator` field will be added to the Argo CD Application spec: + +```yaml +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: example +spec: + # The sourceHydrator field is mutually-exclusive with `source` and with `sources`. If this field is configured, we + # should either throw an error or ignore the other two. + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + # This assumes the Application's environments are modeled as directories. + path: environments/e2e + syncSource: + targetBranch: environments/e2e + path: . + # The hydrateTo field is optional. If specified, Argo CD will write hydrated manifests to this branch instead of the + # syncSource.targetBranch. This allows the user to "stage" a hydrated commit before actually deploying the changes + # by merging them into the syncSource branch. A complete change promotion system can be built around this feature. + hydrateTo: + targetBranch: environments/e2e-next + # The path is assumed to be the same as that in syncSource. +``` + +When the Argo CD application controller detects a new commit on the `drySource`, it queue up the hydration process. + +When the application controller detects a new (hydrated) commit on the `syncSource.targetBranch`, it will sync the manifests. + +### Processing a New Dry Commit + +On noticing a new dry commit, Argo CD will first collect all Applications which have the same `drySource` repo and targetRevision. + +Argo CD will then group those sources by the configured `syncSource` targetBranch. + +```go +package hydrator + +import "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" + +type DrySource struct { + repoURL string + targetRevision string +} + +type SyncSource struct { + targetBranch string +} + +var appGroups map[DrySource]map[SyncSource][]v1alpha1.Application +``` + +Then Argo CD will loop over the apps in each group. For each group, it will run manifest hydration on the configured `drySource.path` and write the result to the configured `syncSource.path`. After looping over all apps in the group and writing all their manifests, it will commit the changes to the configured `syncSource` repoURL and targetBranch (or, if configured, the `hydratedTo` targetBranch). Finally, it will push those changes to git. Then it will repeat this process for the remaining groups. + +The actual push operation should be delegated to the [commit server](./manifest-hydrator/commit-server/README.md). + +To understand how this would work for a simple dev/test/prod setup with two regions, consider this example: + +```yaml +### DEV APPS ### +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: dev-west +spec: + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + path: environments/dev/west + syncSource: + targetBranch: environments/dev + path: west +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: dev-east +spec: + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + path: environments/dev/east + syncSource: + targetBranch: environments/dev + path: east +--- +### TEST APPS ### +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: test-west +spec: + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + path: environments/test/west + syncSource: + targetBranch: environments/test + path: west +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: test-east +spec: + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + path: environments/test/east + syncSource: + targetBranch: environments/prod + path: east +--- +### PROD APPS ### +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: prod-west +spec: + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + path: environments/prod/west + syncSource: + targetBranch: environments/prod + path: west +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: prod-east +spec: + sourceHydrator: + drySource: + repoURL: https://github.com/argoproj/argocd-example-apps + targetRevision: main + path: environments/prod/east + syncSource: + targetBranch: environments/prod + path: east +--- +``` + +Each commit to the dry branch will result in a commit to up to three branches. Each commit to an environment branch will contain changes for west, east, or both (depending on which is affected). Changes originating from a single dry commit are always grouped into a single hydrated commit. + +### Handling External Values Files + +Since only one source may be used in as the dry source, the multi-source approach to external Helm values files will not work here. Instead, we'll recommend that users use the umbrella chart approach. The main reasons for multi-source as an alternative were convenience (no need to maintain the parent chart) and resolving issues with authentication to dependency charts. We believe the simplification is worth the cost of convenience, and we can address the auth issues as standalone bugs. + +An earlier iteration of this proposal attempted to preserve the multi-source style of external value file inclusion by introducing a "magic" `.argocd-hydrator.yaml` file containing `additionalSources` to reference the Helm chart. In the end, it felt like we were re-implementing Helm's dependencies feature or git submodules. It's better to just rely on one of those existing tools. + +### `.argocd-source.yaml` Support + +The `spec.sourceHydrator.drySource` field contains only three fields: `repoURL`, `targetRevision`, and `path`. + +`spec.source` contains a number of fields for configuring manifest hydration tools (`helm`, `kustomize`, and `directory`). That functionality is still available for `spec.sourceHydrator`. But instead of being configured in the Application CR, those values are set in `.argocd-source.yaml`, an existing "override" mechanism for `spec.source`. By requiring that this configuration be set in `.argocd-source.yaml`, we respect the principle that all changes must be made in git instead of in the Application CR. + +### `spec.destination.namespace` Behavior + +The Application `spec.destination.namespace` field is used to set the `metadata.namespace` field of any namespace resources for which that field is not set in the manifests. + +The hydrator will not inject `metadata.namespace` into the hydrated manifests pushed to git. Instead, Argo CD's behavior of injecting that value immediately before applying to the cluster will continue to be used with the `spec.sourceHydrator.syncSource`. + +### Build Environment Support + +For sources specified in `spec.source` or `spec.sources`, Argo CD [sets certain environment variables](https://argo-cd.readthedocs.io/en/stable/user-guide/build-environment/) before running the manifest hydration tool. + +Some of these environment variables may change independently of the dry source and therefore break the reproducibility of manifest hydration (see the [Opinions](#opinions) section). Therefore, only some environment variables will be populated for the `spec.sourceHydrator` source. + +These environment variables will **not** be set: + +* `ARGOCD_APP_NAME` +* `ARGOCD_APP_NAMESPACE` +* `KUBE_VERSION` +* `KUBE_API_VERSIONS` + +These environment variables will be set because they are commit SHAs and are directly and immutably tied to the dry manifest commit: + +* `ARGOCD_APP_REVISION` +* `ARGOCD_APP_REVISION_SHORT` + +These environment variables will be set because they are inherently tied to the manifest hydrator configuration. If these fields set in `spec.sourceHydrator.drySource` change, we are breaking the connection to the original hydrator configuration anyway. + +* `ARGOCD_APP_SOURCE_PATH` +* `ARGOCD_APP_SOURCE_REPO_URL` +* `ARGOCD_APP_SOURCE_TARGET_REVISION` + +### Support for Helm-Specific Features + +#### App Name / Release Name + +By default, Argo CD's `source` and `sources` fields use the Application's name as the release name when hydrating Helm manifests. + +To centralize the source of truth when using `spec.sourceHydrator`, the default release name will be an empty string, and any different release name should be specified in the `helm.releaseName` field in `.argocd-source.yaml`. + +#### Kube API Versions + +`helm install` supports dynamically reading Kube API versions from the destination cluster to adjust manifest output. `helm template` accepts a list of Kube API versions to simulate the same behavior, and Argo CD's `spec.source` and `spec.sources` fields set those API versions when running `helm template`. + +To centralize the source of truth when using `spec.sourceHydrator`, the Kube API versions will not be populated by default. + +Instead, a new field will be added to the Application's `spec.source.helm` field: + +```yaml +kind: Application +spec: + source: + helm: + apiVersions: + - admissionregistration.k8s.io/v1/MutatingWebhookConfiguration + - admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration + - ... etc. +``` + +That field will also be available in `.argocd-source.yaml`: + +```yaml +helm: + apiVersions: + - admissionregistration.k8s.io/v1/MutatingWebhookConfiguration + - admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration + - ... etc. +``` + +So the appropriate way to set Kube API versions for the source hydrator will be to populate the `.argocd-source.yaml` file. + +#### Hydrated Environment Branches + +Representing the dry manifests of environments as branches has well-documented downsides for developer experience. Specifically, it's toilsome for developers to manage moving changes from one branch to another and avoid drift. + +So environments-as-directories has emerged as the standard for good GitOps practices. Change management across directories in a single branch is much easier to perform and reason about. + +**This proposal does not suggest using branches to represent the dry manifests of environments.** As a matter of fact, this proposal codifies the current best practice of representing the dry manifests as directories in a single branch. + +This proposal recommends using different branches for the _hydrated_ representation of environments only. Using different branches has some benefits: + +1) Intuitive grouping of "changes to ship at once" - for example, if you have app-1-east and app-1-west, it makes sense to merge a single hydrated PR to deploy to both of those apps at once +2) Easy-to-read history of a single environment via the commits history +3) Easy comparison between environments using the SCMs' "compare" interfaces + +In other words, branches make a very nice _read_ interface for _hydrated_ manifests while preserving the best-practice of using _directories_ for the _write_ interface. + +### Commit Metadata + +Each output directory should contain two files: manifest.yaml and README.md. manifest.yaml should contain the plain hydrated manifests. The resources should be sorted by namespace, name, group, and kind (in that order). + +The README will be built using the following template: + +````gotemplate +{{ if eq (len .applications) 1 }} +{{ $appName := (index .applications 0).metadata.name }} +# {{ $appName }} Manifests + +[manifest.yaml](./manifest.yaml) contains the hydrated manifests for the {{ $appName }} application. +{{ end }} +{{ if gt (len .applications) 1 }} +{{ $appName := (index .applications 0).metadata.name }} +# Manifests for {{ len .applications }} Applications + +[manifest.yaml](./manifest.yaml) contains the hydrated manifests for these applications: +{{ range $i, $app := .applications }} +- {{ $app.name }} +{{ end }} +{{ end }} + +These are the details of the most recent change; +* Author: {{ .commitAuthor }} +* Message: {{ .commitMessage }} +* Time: {{ .commitTime }} + +To reproduce the manifest hydration, do the following: + +``` +git clone {{ .repoURL }} +cd {{ .repoName }} +git checkout {{ .dryShortSHA }} +{{ range $i, $command := .commands }} +{{ $command }} +{{ end }} +``` +```` + +This template should be admin-configurable. + +Example output might look like this: + +````markdown +# dev-west Manifests + +[manifest.yaml](./manifest.yaml) contains the hydrated manifests for the dev-west application. + +These are the details of the most recent change; +* Author: Michael Crenshaw +* Message: chore: bumped image tag to v0.0.2 +* Time: 2024-03-27 10:32:04 UTC + +To reproduce the manifest hydration, do the following: + +``` +git clone https://github.com/argoproj/argocd-example-apps +cd argocd-example-apps +git checkout ab2382f +kustomize edit set image my-app:v0.0.2 +kustomize build environments/dev/west +``` +```` + +The hydrator will also write a `hydrator.metadata` file containing a JSON representation of all the values available for README templating. This metadata can be used by external systems (e.g. a PR-based promoter system) to generate contextual information about the hydrated manifest's provenance. + +```json +{ + "commands": ["kustomize edit set image my-app:v0.0.2", "kustomize build ."], + "drySHA": "ab2382f", + "commitAuthor": "Michael Crenshaw ", + "commitMessage": "chore: bump Helm dependency chart to 32.1.12", + "repoURL": "https://github.com/argoproj/argocd-example-apps" +} +``` + +To request a commit to the hydrated branch, the application controller will make a call to the CommitManifests service. + +A single call will bundle all the changes destined for a given targetBranch. + +It's the application controller's job to ensure that the user has write access to the repo before making the call. + +```protobuf +// CommitManifests represents the caller's request for some Kubernetes manifests to be pushed to a git repository. +message CommitManifests { + // repoURL is the URL of the repo we're pushing to. HTTPS or SSH URLs are acceptable. + required string repoURL = 1; + // targetBranch is the name of the branch we're pushing to. + required string targetBranch = 2; + // drySHA is the full SHA256 hash of the "dry commit" from which the manifests were hydrated. + required string drySHA = 3; + // commitAuthor is the name of the author of the dry commit. + required string commitAuthor = 4; + // commitMessage is the short commit message from the dry commit. + required string commitMessage = 5; + // commitTime is the dry commit timestamp. + required string commitTime = 6; + // details holds the information about the actual hydrated manifests. + repeated CommitPathDetails details = 7; +} + +// CommitManifestDetails represents the details about a +message CommitPathDetails { + // path is the path to the directory to which these manifests should be written. + required string path = 1; + // manifests is a list of JSON documents representing the Kubernetes manifests. + repeated string manifests = 2; + // readme is a string which will be written to a README.md alongside the manifest.yaml. + required string readme = 3; +} + +message CommitManifestsResponse { +} +``` + +### Push access + +The hydrator will need to push to the git repository. This will require a secret containing the git credentials. + +Write access will be configured via a Kubernetes secret with the following structure: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + labels: + argocd.argoproj.io/secret-type: repository-write +stringData: + url: 'https://github.com/argoproj/argocd-example-apps' + githubAppID: '123456' + githubInstallationID: '123456' + githubAppPrivateKey: | + ----- +``` + +### Use cases + +#### Use case 1: + +An organization with strong requirements around change auditing might enable manifest hydration in order to generate a full history of changes. + +#### Use case 2: + +### Implementation Details/Notes/Constraints + +### Detailed examples + +### Security Considerations + +This proposal would involve introducing a component capable of pushing to git. + +We'll need to consider what git permissions setup to recommend, what security features we should recommend enabling (e.g. branch protection), etc. + +We'll also need to consider how to store the git push secrets. It's probable that they'll need to be stored in a namespace separate from the other Argo CD components to provide a bit extra protection. + +### Risks and Mitigations + +### Upgrade / Downgrade Strategy + +## Drawbacks + +## Alternatives diff --git a/docs/proposals/manifest-hydrator/README.md b/docs/proposals/manifest-hydrator/README.md new file mode 100644 index 0000000000000..e2af5481e4596 --- /dev/null +++ b/docs/proposals/manifest-hydrator/README.md @@ -0,0 +1,44 @@ +# Argo CD Manifest Hydrator + +Most Argo CD Applications don't directly use plain Kubernetes manifests. They reference a Helm chart or some Kustomize manifests, and then Argo CD transforms those sources into their final form (plain Kubernetes manifests). + +Having Argo CD quietly do this transformation behind the scenes is convenient. But it can make it harder for developers to understand the full state of their application, both current and past. Hydrating (also known as "rendering") the sources and pushing the hydrated manifests to git is a common technique to preserve a full history of an Application's state. + +Argo CD provides first-class tooling to hydrate manifests and push them to git. This document explains how to take advantage of that tooling. + +## Setting up git Push Access + +To use Argo CD's source hydration tooling, you have to grant Argo CD push access to all the repositories for apps using the source hydrator. + +### Security Considerations + +Argo CD stores git push secrets separately from the main Argo CD components and separately from git pull credentials to minimize the possibility of a malicious actor stealing the secrets or hijacking Argo CD components to push malicious changes. + +Pushing hydrated manifests to git can improve security by ensuring that all state changes are stored and auditable. If a malicious actor does manage to produce malicious changes in manifests, those changes will be discoverable in git instead of living only in the live cluster state. + +You should use your SCM's security mechanisms to ensure that Argo CD can only push to the allowed repositories and branches. + +### Adding the Access Credentials + +To set up push access, add a secret to the `argocd-push` namespace with the following format: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: argocd-example-apps + labels: + # Note that this is "repository-push" instead of "repository". The same secret should never be used for both push and pull access. + argocd.argoproj.io/secret-type: repository-push +type: Opaque +stringData: + url: https://github.com/argoproj/argocd-example-apps.git + username: '****' + password: '****' +``` + +Once the secret is available, any Application which has pull access to a given repo will be able to use the source hydration tooling to also push to that repo. + +## Using the `sourceHydrator` Field + +## Migrating from the `source` or `sources` Field diff --git a/docs/proposals/manifest-hydrator/commit-server/README.md b/docs/proposals/manifest-hydrator/commit-server/README.md new file mode 100644 index 0000000000000..b87a6ef0a2445 --- /dev/null +++ b/docs/proposals/manifest-hydrator/commit-server/README.md @@ -0,0 +1,38 @@ +# Commit Server + +The Argo CD Commit Server provides push access to git repositories for hydrated manifests. + +The server exposes a gRPC service which accepts requests to push hydrated manifests to a git repository. This is the interface: + +```protobuf +// CommitManifests represents the caller's request for some Kubernetes manifests to be pushed to a git repository. +message CommitManifests { + // repoURL is the URL of the repo we're pushing to. HTTPS or SSH URLs are acceptable. + required string repoURL = 1; + // targetBranch is the name of the branch we're pushing to. + required string targetBranch = 2; + // drySHA is the full SHA256 hash of the "dry commit" from which the manifests were hydrated. + required string drySHA = 3; + // commitAuthor is the name of the author of the dry commit. + required string commitAuthor = 4; + // commitMessage is the short commit message from the dry commit. + required string commitMessage = 5; + // commitTime is the dry commit timestamp. + required string commitTime = 6; + // details holds the information about the actual hydrated manifests. + repeated CommitPathDetails details = 7; +} + +// CommitManifestDetails represents the details about a +message CommitPathDetails { + // path is the path to the directory to which these manifests should be written. + required string path = 1; + // manifests is a list of JSON documents representing the Kubernetes manifests. + repeated string manifests = 2; + // readme is a string which will be written to a README.md alongside the manifest.yaml. + required string readme = 3; +} + +message CommitManifestsResponse { +} +``` diff --git a/docs/snyk/index.md b/docs/snyk/index.md index 893eb93315f1e..586bbaf6a75be 100644 --- a/docs/snyk/index.md +++ b/docs/snyk/index.md @@ -23,39 +23,39 @@ recent minor releases. | [install.yaml](master/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](master/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.13.1 +### v2.13.2 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.13.1/argocd-test.html) | 0 | 0 | 7 | 2 | -| [ui/yarn.lock](v2.13.1/argocd-test.html) | 0 | 0 | 1 | 0 | -| [dex:v2.41.1](v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html) | 0 | 0 | 0 | 2 | -| [haproxy:2.6.17-alpine](v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | -| [redis:7.0.15-alpine](v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [argocd:v2.13.1](v2.13.1/quay.io_argoproj_argocd_v2.13.1.html) | 0 | 0 | 3 | 10 | -| [redis:7.0.15-alpine](v2.13.1/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [install.yaml](v2.13.1/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.13.1/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.13.2/argocd-test.html) | 1 | 0 | 7 | 2 | +| [ui/yarn.lock](v2.13.2/argocd-test.html) | 0 | 0 | 1 | 0 | +| [dex:v2.41.1](v2.13.2/ghcr.io_dexidp_dex_v2.41.1.html) | 0 | 0 | 0 | 2 | +| [haproxy:2.6.17-alpine](v2.13.2/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | +| [redis:7.0.15-alpine](v2.13.2/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:v2.13.2](v2.13.2/quay.io_argoproj_argocd_v2.13.2.html) | 0 | 0 | 3 | 10 | +| [redis:7.0.15-alpine](v2.13.2/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | +| [install.yaml](v2.13.2/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.13.2/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.12.7 +### v2.12.8 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.12.7/argocd-test.html) | 0 | 0 | 8 | 2 | -| [ui/yarn.lock](v2.12.7/argocd-test.html) | 0 | 0 | 1 | 0 | -| [dex:v2.38.0](v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 7 | -| [haproxy:2.6.17-alpine](v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | -| [redis:7.0.15-alpine](v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [argocd:v2.12.7](v2.12.7/quay.io_argoproj_argocd_v2.12.7.html) | 0 | 0 | 3 | 11 | -| [redis:7.0.15-alpine](v2.12.7/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [install.yaml](v2.12.7/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.12.7/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.12.8/argocd-test.html) | 1 | 0 | 8 | 2 | +| [ui/yarn.lock](v2.12.8/argocd-test.html) | 0 | 0 | 1 | 0 | +| [dex:v2.38.0](v2.12.8/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 7 | +| [haproxy:2.6.17-alpine](v2.12.8/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | +| [redis:7.0.15-alpine](v2.12.8/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:v2.12.8](v2.12.8/quay.io_argoproj_argocd_v2.12.8.html) | 0 | 0 | 3 | 10 | +| [redis:7.0.15-alpine](v2.12.8/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | +| [install.yaml](v2.12.8/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.12.8/argocd-iac-namespace-install.html) | - | - | - | - | ### v2.11.12 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.11.12/argocd-test.html) | 0 | 2 | 9 | 2 | +| [go.mod](v2.11.12/argocd-test.html) | 1 | 2 | 9 | 2 | | [ui/yarn.lock](v2.11.12/argocd-test.html) | 0 | 0 | 1 | 0 | | [dex:v2.38.0](v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 7 | | [haproxy:2.6.14-alpine](v2.11.12/haproxy_2.6.14-alpine.html) | 0 | 1 | 7 | 7 | diff --git a/docs/snyk/master/argocd-iac-install.html b/docs/snyk/master/argocd-iac-install.html index 0dffc06728edd..5c580258abd3b 100644 --- a/docs/snyk/master/argocd-iac-install.html +++ b/docs/snyk/master/argocd-iac-install.html @@ -456,7 +456,7 @@

Snyk test report

-

December 8th 2024, 12:23:04 am (UTC+00:00)

+

December 15th 2024, 12:23:55 am (UTC+00:00)

Scanned the following path: @@ -2861,7 +2861,7 @@

Container's or Pod's UID could clash with hos
  • - Line number: 24840 + Line number: 24846
  • diff --git a/docs/snyk/master/argocd-iac-namespace-install.html b/docs/snyk/master/argocd-iac-namespace-install.html index 9d981c5ed4b14..acfee91c3423b 100644 --- a/docs/snyk/master/argocd-iac-namespace-install.html +++ b/docs/snyk/master/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:23:14 am (UTC+00:00)

    +

    December 15th 2024, 12:24:05 am (UTC+00:00)

    Scanned the following path: @@ -2815,7 +2815,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 2163 + Line number: 2169
  • diff --git a/docs/snyk/master/argocd-test.html b/docs/snyk/master/argocd-test.html index 0e34c9d221c4f..6f8eea772af3e 100644 --- a/docs/snyk/master/argocd-test.html +++ b/docs/snyk/master/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:20:56 am (UTC+00:00)

    +

    December 15th 2024, 12:21:36 am (UTC+00:00)

    Scanned the following paths: @@ -470,7 +470,7 @@

    Snyk test report

    7 known vulnerabilities
    26 vulnerable dependency paths
    -
    2158 dependencies
    +
    2160 dependencies
    diff --git a/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html b/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html index bd67d192d8784..b67a18ff82724 100644 --- a/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html +++ b/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:21:06 am (UTC+00:00)

    +

    December 15th 2024, 12:21:47 am (UTC+00:00)

    Scanned the following paths: @@ -469,8 +469,8 @@

    Snyk test report

    -
    22 known vulnerabilities
    -
    43 vulnerable dependency paths
    +
    23 known vulnerabilities
    +
    44 vulnerable dependency paths
    969 dependencies

    @@ -479,6 +479,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 /usr/local/bin/gomplate +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v4@* and golang.org/x/crypto/ssh@v0.24.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v4@* + + golang.org/x/crypto/ssh@v0.24.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Insertion of Sensitive Information into Log File

    diff --git a/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index 4f68c7b9cc6f9..5dc1585aadaa3 100644 --- a/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:21:11 am (UTC+00:00)

    +

    December 15th 2024, 12:21:52 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index 8453a03fac230..43f65cad79ae6 100644 --- a/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:21:15 am (UTC+00:00)

    +

    December 15th 2024, 12:22:00 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/master/quay.io_argoproj_argocd_latest.html b/docs/snyk/master/quay.io_argoproj_argocd_latest.html index 18c692c3c0536..7617106e2e62c 100644 --- a/docs/snyk/master/quay.io_argoproj_argocd_latest.html +++ b/docs/snyk/master/quay.io_argoproj_argocd_latest.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:21:33 am (UTC+00:00)

    +

    December 15th 2024, 12:22:20 am (UTC+00:00)

    Scanned the following paths: @@ -472,7 +472,7 @@

    Snyk test report

    20 known vulnerabilities
    100 vulnerable dependency paths
    -
    2378 dependencies
    +
    2380 dependencies
    diff --git a/docs/snyk/master/redis_7.0.15-alpine.html b/docs/snyk/master/redis_7.0.15-alpine.html index 3db408ad152bb..08afe3592a136 100644 --- a/docs/snyk/master/redis_7.0.15-alpine.html +++ b/docs/snyk/master/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:21:38 am (UTC+00:00)

    +

    December 15th 2024, 12:22:25 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.11.12/argocd-iac-install.html b/docs/snyk/v2.11.12/argocd-iac-install.html index 8098344f87387..77349b6faacb1 100644 --- a/docs/snyk/v2.11.12/argocd-iac-install.html +++ b/docs/snyk/v2.11.12/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:30:13 am (UTC+00:00)

    +

    December 15th 2024, 12:31:10 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.12/argocd-iac-namespace-install.html b/docs/snyk/v2.11.12/argocd-iac-namespace-install.html index 191e8f076b21d..11b4414c6af56 100644 --- a/docs/snyk/v2.11.12/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.11.12/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:30:22 am (UTC+00:00)

    +

    December 15th 2024, 12:31:19 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.12/argocd-test.html b/docs/snyk/v2.11.12/argocd-test.html index 7dbbfb552e48a..61dbff2086e1b 100644 --- a/docs/snyk/v2.11.12/argocd-test.html +++ b/docs/snyk/v2.11.12/argocd-test.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:28:19 am (UTC+00:00)

    +

    December 15th 2024, 12:29:14 am (UTC+00:00)

    Scanned the following paths: @@ -467,8 +467,8 @@

    Snyk test report

    -
    14 known vulnerabilities
    -
    1075 vulnerable dependency paths
    +
    15 known vulnerabilities
    +
    1089 vulnerable dependency paths
    2041 dependencies
    @@ -477,6 +477,277 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 go.mod +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and golang.org/x/crypto/ssh@0.19.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + golang.org/x/crypto/ssh/knownhosts@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.11.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.11.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.19.0 + + golang.org/x/crypto/ssh@0.19.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Denial of Service (DoS)

    diff --git a/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html index 7706e17895a5d..fb7ec90e45f43 100644 --- a/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html +++ b/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:28:28 am (UTC+00:00)

    +

    December 15th 2024, 12:29:22 am (UTC+00:00)

    Scanned the following paths: @@ -469,8 +469,8 @@

    Snyk test report

    -
    41 known vulnerabilities
    -
    129 vulnerable dependency paths
    +
    42 known vulnerabilities
    +
    130 vulnerable dependency paths
    829 dependencies
    @@ -479,6 +479,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 /usr/local/bin/gomplate +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and golang.org/x/crypto/ssh@v0.18.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + + golang.org/x/crypto/ssh@v0.18.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Allocation of Resources Without Limits or Throttling

    diff --git a/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html b/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html index 41c0079895977..3e1a3e3b56dc0 100644 --- a/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:28:32 am (UTC+00:00)

    +

    December 15th 2024, 12:29:27 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html b/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html index 316876f7f9bfe..30082caf72a84 100644 --- a/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html +++ b/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:28:51 am (UTC+00:00)

    +

    December 15th 2024, 12:29:45 am (UTC+00:00)

    Scanned the following paths: @@ -470,8 +470,8 @@

    Snyk test report

    -
    37 known vulnerabilities
    -
    209 vulnerable dependency paths
    +
    38 known vulnerabilities
    +
    210 vulnerable dependency paths
    2280 dependencies
    @@ -480,6 +480,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.11.12/argoproj/argo-cd/v2 /usr/local/bin/argocd +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and golang.org/x/crypto/ssh@v0.19.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + + golang.org/x/crypto/ssh@v0.19.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Denial of Service (DoS)

    @@ -5191,6 +5265,7 @@

    References

  • https://curl.se/docs/CVE-2024-9681.json
  • https://hackerone.com/reports/2764830
  • http://www.openwall.com/lists/oss-security/2024/11/06/2
  • +
  • https://security.netapp.com/advisory/ntap-20241213-0006/

  • diff --git a/docs/snyk/v2.11.12/redis_7.0.15-alpine.html b/docs/snyk/v2.11.12/redis_7.0.15-alpine.html index a6a6bc8e0e1f5..18fb60b5c1b68 100644 --- a/docs/snyk/v2.11.12/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.11.12/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:28:55 am (UTC+00:00)

    +

    December 15th 2024, 12:29:49 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.12.7/argocd-iac-install.html b/docs/snyk/v2.12.8/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.12.7/argocd-iac-install.html rename to docs/snyk/v2.12.8/argocd-iac-install.html index 5b917695af4b7..2cbc23395cac5 100644 --- a/docs/snyk/v2.12.7/argocd-iac-install.html +++ b/docs/snyk/v2.12.8/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:27:55 am (UTC+00:00)

    +

    December 15th 2024, 12:28:50 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.12.7/argocd-iac-namespace-install.html b/docs/snyk/v2.12.8/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.12.7/argocd-iac-namespace-install.html rename to docs/snyk/v2.12.8/argocd-iac-namespace-install.html index f1787b91d225c..0bd319de619ab 100644 --- a/docs/snyk/v2.12.7/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.12.8/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:28:04 am (UTC+00:00)

    +

    December 15th 2024, 12:28:59 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.13.1/argocd-test.html b/docs/snyk/v2.12.8/argocd-test.html similarity index 73% rename from docs/snyk/v2.13.1/argocd-test.html rename to docs/snyk/v2.12.8/argocd-test.html index 13f3c2956ffed..9769ab54cf9c5 100644 --- a/docs/snyk/v2.13.1/argocd-test.html +++ b/docs/snyk/v2.12.8/argocd-test.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:23:27 am (UTC+00:00)

    +

    December 15th 2024, 12:26:45 am (UTC+00:00)

    Scanned the following paths: @@ -467,9 +467,9 @@

    Snyk test report

    -
    10 known vulnerabilities
    -
    36 vulnerable dependency paths
    -
    2131 dependencies
    +
    12 known vulnerabilities
    +
    54 vulnerable dependency paths
    +
    2061 dependencies
    @@ -477,6 +477,314 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 go.mod +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and golang.org/x/crypto/ssh@0.23.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + code.gitea.io/sdk/gitea@0.18.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + golang.org/x/crypto/ssh/knownhosts@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + code.gitea.io/sdk/gitea@0.18.0 + + github.com/go-fed/httpsig@1.1.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + code.gitea.io/sdk/gitea@0.18.0 + + golang.org/x/crypto/ssh/agent@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.23.0 + + golang.org/x/crypto/ssh@0.23.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    LGPL-3.0 license

    @@ -538,6 +846,118 @@

    Detailed paths

    More about this vulnerability

    +
    +
    +

    Denial of Service (DoS)

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 go.mod +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + github.com/rs/cors +
    • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 + + github.com/rs/cors@1.9.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Denial of Service (DoS) through the processing of malicious preflight requests that include a Access-Control-Request-Headers header with excessive commas. An attacker can induce excessive memory consumption and potentially crash the server by sending specially crafted requests.

    +

    PoC

    +
    
    +        func BenchmarkPreflightAdversarialACRH(b *testing.B) {
    +            resps := makeFakeResponses(b.N)
    +            req, _ := http.NewRequest(http.MethodOptions, dummyEndpoint, nil)
    +            req.Header.Add(headerOrigin, dummyOrigin)
    +            req.Header.Add(headerACRM, http.MethodGet)
    +            req.Header[headerACRH] = adversarialACRH
    +            handler := Default().Handler(testHandler)
    +        
    +            b.ReportAllocs()
    +            b.ResetTimer()
    +            for i := 0; i < b.N; i++ {
    +                handler.ServeHTTP(resps[i], req)
    +            }
    +        }
    +        
    +        var adversarialACRH []string
    +        
    +        func init() { // populates adversarialACRH
    +            n := int(math.Floor(math.Sqrt(http.DefaultMaxHeaderBytes)))
    +            commas := strings.Repeat(",", n)
    +            res := make([]string, n)
    +            for i := range res {
    +                res[i] = commas
    +            }
    +            adversarialACRH = res
    +        }
    +        
    +

    Details

    +

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    +

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    +

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    +

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    +

    Two common types of DoS vulnerabilities:

    +
      +
    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      +
    • +
    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      +
    • +
    +

    Remediation

    +

    Upgrade github.com/rs/cors to version 1.11.0 or higher.

    +

    References

    + + +
    + + +

    MPL-2.0 license

    @@ -625,7 +1045,7 @@

    MPL-2.0 license

  • Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.19.0 and others + github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.18.0 and others
  • @@ -639,7 +1059,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - code.gitea.io/sdk/gitea@0.19.0 + code.gitea.io/sdk/gitea@0.18.0 github.com/hashicorp/go-version@1.6.0 @@ -721,7 +1141,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/xanzy/go-gitlab@0.109.0 + github.com/xanzy/go-gitlab@0.91.1 github.com/hashicorp/go-retryablehttp@0.7.7 @@ -927,7 +1347,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/xanzy/go-gitlab@0.109.0 + github.com/xanzy/go-gitlab@0.91.1 github.com/hashicorp/go-cleanhttp@0.5.2 @@ -938,7 +1358,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/xanzy/go-gitlab@0.109.0 + github.com/xanzy/go-gitlab@0.91.1 github.com/hashicorp/go-retryablehttp@0.7.7 @@ -1074,7 +1494,7 @@

    MPL-2.0 license

  • Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.14.0 + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1
  • @@ -1089,7 +1509,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/gosimple/slug@1.14.0 + github.com/gosimple/slug@1.13.1 @@ -1394,7 +1814,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/bradleyfalzon/ghinstallation/v2@2.11.0 + github.com/bradleyfalzon/ghinstallation/v2@2.6.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1407,7 +1827,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.11.0 + github.com/bradleyfalzon/ghinstallation/v2@2.6.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1422,7 +1842,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.11.0 + github.com/bradleyfalzon/ghinstallation/v2@2.6.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1437,7 +1857,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.11.0 + github.com/bradleyfalzon/ghinstallation/v2@2.6.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1471,7 +1891,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.11.0 + github.com/bradleyfalzon/ghinstallation/v2@2.6.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1488,7 +1908,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.11.0 + github.com/bradleyfalzon/ghinstallation/v2@2.6.0 github.com/golang-jwt/jwt/v4@4.5.0 diff --git a/docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/v2.12.8/ghcr.io_dexidp_dex_v2.38.0.html similarity index 97% rename from docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html rename to docs/snyk/v2.12.8/ghcr.io_dexidp_dex_v2.38.0.html index a7c95cb07bbef..f8bac868b31c9 100644 --- a/docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html +++ b/docs/snyk/v2.12.8/ghcr.io_dexidp_dex_v2.38.0.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:26:04 am (UTC+00:00)

    +

    December 15th 2024, 12:26:55 am (UTC+00:00)

    Scanned the following paths: @@ -469,8 +469,8 @@

    Snyk test report

    -
    41 known vulnerabilities
    -
    129 vulnerable dependency paths
    +
    42 known vulnerabilities
    +
    130 vulnerable dependency paths
    829 dependencies
    @@ -479,6 +479,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 /usr/local/bin/gomplate +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and golang.org/x/crypto/ssh@v0.18.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + + golang.org/x/crypto/ssh@v0.18.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Allocation of Resources Without Limits or Throttling

    diff --git a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/v2.12.8/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html similarity index 99% rename from docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html rename to docs/snyk/v2.12.8/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index 3753b33f73d7e..e024f2d331cf3 100644 --- a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/v2.12.8/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:23:37 am (UTC+00:00)

    +

    December 15th 2024, 12:26:58 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/v2.12.8/public.ecr.aws_docker_library_redis_7.0.15-alpine.html similarity index 99% rename from docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html rename to docs/snyk/v2.12.8/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index b69828ca77f11..46dc068dbad3d 100644 --- a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/v2.12.8/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:26:12 am (UTC+00:00)

    +

    December 15th 2024, 12:27:03 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html b/docs/snyk/v2.12.8/quay.io_argoproj_argocd_v2.12.8.html similarity index 94% rename from docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html rename to docs/snyk/v2.12.8/quay.io_argoproj_argocd_v2.12.8.html index 4d80f74f4b008..3366948878d9a 100644 --- a/docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html +++ b/docs/snyk/v2.12.8/quay.io_argoproj_argocd_v2.12.8.html @@ -456,16 +456,16 @@

    Snyk test report

    -

    December 8th 2024, 12:26:30 am (UTC+00:00)

    +

    December 15th 2024, 12:27:23 am (UTC+00:00)

    Scanned the following paths:
      -
    • quay.io/argoproj/argocd:v2.12.7/argoproj/argocd/Dockerfile (deb)
    • -
    • quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2//usr/local/bin/argocd (gomodules)
    • -
    • quay.io/argoproj/argocd:v2.12.7//usr/local/bin/kustomize (gomodules)
    • -
    • quay.io/argoproj/argocd:v2.12.7/helm/v3//usr/local/bin/helm (gomodules)
    • -
    • quay.io/argoproj/argocd:v2.12.7/git-lfs/git-lfs//usr/bin/git-lfs (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.12.8/argoproj/argocd/Dockerfile (deb)
    • +
    • quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2//usr/local/bin/argocd (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.12.8//usr/local/bin/kustomize (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.12.8/helm/v3//usr/local/bin/helm (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.12.8/git-lfs/git-lfs//usr/bin/git-lfs (gomodules)
    @@ -480,6 +480,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and golang.org/x/crypto/ssh@v0.23.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + + golang.org/x/crypto/ssh@v0.23.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Insecure Storage of Sensitive Information

    @@ -492,7 +566,7 @@

    Insecure Storage of Sensitive Information

    • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
    • Package Manager: ubuntu:24.04 @@ -505,7 +579,7 @@

      Insecure Storage of Sensitive Information

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and pam/libpam0g@1.5.3-5ubuntu5.1 + docker-image|quay.io/argoproj/argocd@v2.12.8 and pam/libpam0g@1.5.3-5ubuntu5.1
    @@ -518,7 +592,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam0g@1.5.3-5ubuntu5.1 @@ -527,7 +601,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -538,7 +612,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 util-linux@2.39.3-9ubuntu6.1 @@ -549,7 +623,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -564,7 +638,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -581,7 +655,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -600,7 +674,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-modules-bin@1.5.3-5ubuntu5.1 @@ -609,7 +683,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -626,7 +700,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-modules@1.5.3-5ubuntu5.1 @@ -635,7 +709,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -646,7 +720,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -657,7 +731,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -672,7 +746,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -681,7 +755,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -730,7 +804,7 @@

      Improper Authentication

      • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
      • Package Manager: ubuntu:24.04 @@ -743,7 +817,7 @@

        Improper Authentication

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and pam/libpam0g@1.5.3-5ubuntu5.1 + docker-image|quay.io/argoproj/argocd@v2.12.8 and pam/libpam0g@1.5.3-5ubuntu5.1
      @@ -756,7 +830,7 @@

      Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam0g@1.5.3-5ubuntu5.1 @@ -765,7 +839,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -776,7 +850,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 util-linux@2.39.3-9ubuntu6.1 @@ -787,7 +861,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -802,7 +876,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -819,7 +893,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -838,7 +912,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-modules-bin@1.5.3-5ubuntu5.1 @@ -847,7 +921,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -864,7 +938,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-modules@1.5.3-5ubuntu5.1 @@ -873,7 +947,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -884,7 +958,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -895,7 +969,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -910,7 +984,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -919,7 +993,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -966,7 +1040,7 @@

        CVE-2024-26462

        • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
        • Package Manager: ubuntu:24.04 @@ -980,7 +1054,7 @@

          CVE-2024-26462

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.12.8, git@1:2.43.0-1ubuntu7.1 and others
        @@ -992,146 +1066,146 @@

        Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 openssh/openssh-client@1:9.6p1-3ubuntu13.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 libssh/libssh-4@0.10.6-2build2 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 - krb5/krb5-locales@1.20.1-6ubuntu2.1 + krb5/krb5-locales@1.20.1-6ubuntu2.2 @@ -1174,7 +1248,7 @@

          LGPL-3.0 license

          • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
          • Package Manager: golang @@ -1234,7 +1308,7 @@

            Denial of Service (DoS)

            • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
            • Package Manager: golang @@ -1344,7 +1418,7 @@

              MPL-2.0 license

              • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
              • Package Manager: golang @@ -1404,7 +1478,7 @@

                MPL-2.0 license

                • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
                • Package Manager: golang @@ -1464,7 +1538,7 @@

                  MPL-2.0 license

                  • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
                  • Package Manager: golang @@ -1524,7 +1598,7 @@

                    MPL-2.0 license

                    • - Manifest file: quay.io/argoproj/argocd:v2.12.7/helm/v3 /usr/local/bin/helm + Manifest file: quay.io/argoproj/argocd:v2.12.8/helm/v3 /usr/local/bin/helm
                    • Package Manager: golang @@ -1584,7 +1658,7 @@

                      MPL-2.0 license

                      • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
                      • Package Manager: golang @@ -1644,7 +1718,7 @@

                        MPL-2.0 license

                        • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
                        • Package Manager: golang @@ -1704,7 +1778,7 @@

                          Release of Invalid Pointer or Reference

                          • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                          • Package Manager: ubuntu:24.04 @@ -1717,7 +1791,7 @@

                            Release of Invalid Pointer or Reference

                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and patch@2.7.6-7build3 + docker-image|quay.io/argoproj/argocd@v2.12.8 and patch@2.7.6-7build3
                          @@ -1730,7 +1804,7 @@

                          Detailed paths

                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 patch@2.7.6-7build3 @@ -1774,7 +1848,7 @@

                            Double Free

                            • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                            • Package Manager: ubuntu:24.04 @@ -1787,7 +1861,7 @@

                              Double Free

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and patch@2.7.6-7build3 + docker-image|quay.io/argoproj/argocd@v2.12.8 and patch@2.7.6-7build3
                            @@ -1800,7 +1874,7 @@

                            Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 patch@2.7.6-7build3 @@ -1849,7 +1923,7 @@

                              CVE-2024-41996

                              • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                              • Package Manager: ubuntu:24.04 @@ -1862,7 +1936,7 @@

                                CVE-2024-41996

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and openssl/libssl3t64@3.0.13-0ubuntu3.4 + docker-image|quay.io/argoproj/argocd@v2.12.8 and openssl/libssl3t64@3.0.13-0ubuntu3.4
                              @@ -1875,7 +1949,7 @@

                              Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 openssl/libssl3t64@3.0.13-0ubuntu3.4 @@ -1884,7 +1958,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 coreutils@9.4-3ubuntu6 @@ -1895,7 +1969,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 cyrus-sasl2/libsasl2-modules@2.1.28+dfsg1-5ubuntu3.1 @@ -1906,7 +1980,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 libfido2/libfido2-1@1.14.0-1build3 @@ -1917,7 +1991,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 openssh/openssh-client@1:9.6p1-3ubuntu13.5 @@ -1928,7 +2002,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 ca-certificates@20240203 @@ -1941,11 +2015,11 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 libssh/libssh-4@0.10.6-2build2 @@ -1956,15 +2030,15 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 openssl/libssl3t64@3.0.13-0ubuntu3.4 @@ -1973,13 +2047,13 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - openldap/libldap2@2.6.7+dfsg-1~exp1ubuntu8 + openldap/libldap2@2.6.7+dfsg-1~exp1ubuntu8.1 cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-5ubuntu3.1 @@ -1990,7 +2064,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 openssl@3.0.13-0ubuntu3.4 @@ -1999,7 +2073,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 ca-certificates@20240203 @@ -2047,7 +2121,7 @@

                                Information Exposure

                                • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                                • Package Manager: ubuntu:24.04 @@ -2060,7 +2134,7 @@

                                  Information Exposure

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and libgcrypt20@1.10.3-2build1 + docker-image|quay.io/argoproj/argocd@v2.12.8 and libgcrypt20@1.10.3-2build1
                                @@ -2073,7 +2147,7 @@

                                Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 libgcrypt20@1.10.3-2build1 @@ -2082,7 +2156,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/dirmngr@2.4.4-2ubuntu17 @@ -2093,7 +2167,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2104,7 +2178,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg-agent@2.4.4-2ubuntu17 @@ -2115,7 +2189,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -2128,7 +2202,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -2141,7 +2215,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2154,7 +2228,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -2211,7 +2285,7 @@

                                  CVE-2024-26458

                                  • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                                  • Package Manager: ubuntu:24.04 @@ -2225,7 +2299,7 @@

                                    CVE-2024-26458

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.12.8, git@1:2.43.0-1ubuntu7.1 and others
                                  @@ -2237,146 +2311,146 @@

                                  Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 openssh/openssh-client@1:9.6p1-3ubuntu13.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 libssh/libssh-4@0.10.6-2build2 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 - krb5/krb5-locales@1.20.1-6ubuntu2.1 + krb5/krb5-locales@1.20.1-6ubuntu2.2 @@ -2419,7 +2493,7 @@

                                    CVE-2024-26461

                                    • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                                    • Package Manager: ubuntu:24.04 @@ -2433,7 +2507,7 @@

                                      CVE-2024-26461

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.12.8, git@1:2.43.0-1ubuntu7.1 and others
                                    @@ -2445,146 +2519,146 @@

                                    Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2 - krb5/libk5crypto3@1.20.1-6ubuntu2.1 + krb5/libk5crypto3@1.20.1-6ubuntu2.2 - krb5/libkrb5support0@1.20.1-6ubuntu2.1 + krb5/libkrb5support0@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2 - krb5/libkrb5-3@1.20.1-6ubuntu2.1 + krb5/libkrb5-3@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 openssh/openssh-client@1:9.6p1-3ubuntu13.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.5 libssh/libssh-4@0.10.6-2build2 - krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.1 + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2.2
                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 - krb5/krb5-locales@1.20.1-6ubuntu2.1 + krb5/krb5-locales@1.20.1-6ubuntu2.2 @@ -2627,7 +2701,7 @@

                                      Out-of-bounds Write

                                      • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                                      • Package Manager: ubuntu:24.04 @@ -2640,7 +2714,7 @@

                                        Out-of-bounds Write

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and gnupg2/gpgv@2.4.4-2ubuntu17 + docker-image|quay.io/argoproj/argocd@v2.12.8 and gnupg2/gpgv@2.4.4-2ubuntu17
                                      @@ -2653,7 +2727,7 @@

                                      Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpgv@2.4.4-2ubuntu17 @@ -2662,7 +2736,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 apt@2.7.14build2 @@ -2673,7 +2747,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/dirmngr@2.4.4-2ubuntu17 @@ -2684,7 +2758,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg-agent@2.4.4-2ubuntu17 @@ -2695,7 +2769,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2706,7 +2780,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/dirmngr@2.4.4-2ubuntu17 @@ -2715,7 +2789,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2724,7 +2798,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 gnupg2/gpg-agent@2.4.4-2ubuntu17 @@ -2773,7 +2847,7 @@

                                        Allocation of Resources Without Limits or Throttling

                                      • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                                      • Package Manager: ubuntu:24.04 @@ -2786,7 +2860,7 @@

                                        Allocation of Resources Without Limits or Throttling

                                        Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and glibc/libc-bin@2.39-0ubuntu8.3 + docker-image|quay.io/argoproj/argocd@v2.12.8 and glibc/libc-bin@2.39-0ubuntu8.3
                                      @@ -2799,7 +2873,7 @@

                                      Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 glibc/libc-bin@2.39-0ubuntu8.3 @@ -2808,7 +2882,7 @@

                                        Detailed paths

                                      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 glibc/libc6@2.39-0ubuntu8.3 @@ -2854,7 +2928,7 @@

                                        Insufficient Documentation of Error Handling Techniques<
                                        • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
                                        • Package Manager: golang @@ -2923,7 +2997,7 @@

                                          Insufficient Documentation of Error Handling Techniques<
                                          • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argo-cd/v2 /usr/local/bin/argocd
                                          • Package Manager: golang @@ -2992,7 +3066,7 @@

                                            Improper Input Validation

                                            • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
                                            • Package Manager: ubuntu:24.04 @@ -3006,7 +3080,7 @@

                                              Improper Input Validation

                                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.12.8, git@1:2.43.0-1ubuntu7.1 and others
                                            @@ -3018,7 +3092,7 @@

                                            Detailed paths

                                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 @@ -3029,7 +3103,7 @@

                                              Detailed paths

                                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git@1:2.43.0-1ubuntu7.1 @@ -3038,7 +3112,7 @@

                                              Detailed paths

                                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 git-lfs@3.4.1-1ubuntu0.2 @@ -3072,100 +3146,6 @@

                                              References

                                              More about this vulnerability

    -
    -
    -

    Insufficient Comparison

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile -
    • -
    • - Package Manager: ubuntu:24.04 -
    • -
    • - Vulnerable module: - - curl/libcurl3t64-gnutls -
    • - -
    • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.12.7, git@1:2.43.0-1ubuntu7.1 and others -
    • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - - git@1:2.43.0-1ubuntu7.1 - - curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.4 - - - -
    • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. - See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    -

    When curl is asked to use HSTS, the expiry time for a subdomain might - overwrite a parent domain's cache entry, making it end sooner or later than - otherwise intended.

    -

    This affects curl using applications that enable HSTS and use URLs with the - insecure HTTP:// scheme and perform transfers with hosts like - x.example.com as well as example.com where the first host is a subdomain - of the second host.

    -

    (The HSTS cache either needs to have been populated manually or there needs to - have been previous HTTPS accesses done as the cache needs to have entries for - the domains involved to trigger this problem.)

    -

    When x.example.com responds with Strict-Transport-Security: headers, this - bug can make the subdomain's expiry timeout bleed over and get set for the - parent domain example.com in curl's HSTS cache.

    -

    The result of a triggered bug is that HTTP accesses to example.com get - converted to HTTPS for a different period of time than what was asked for by - the origin server. If example.com for example stops supporting HTTPS at its - expiry time, curl might then fail to access http://example.com until the - (wrongly set) timeout expires. This bug can also expire the parent's entry - earlier, thus making curl inadvertently switch back to insecure HTTP earlier - than otherwise intended.

    -

    Remediation

    -

    Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.5 or higher.

    -

    References

    - - -
    - - -

    Improper Input Validation

    @@ -3179,7 +3159,7 @@

    Improper Input Validation

    • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.12.8/argoproj/argocd Dockerfile
    • Package Manager: ubuntu:24.04 @@ -3192,7 +3172,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 and coreutils@9.4-3ubuntu6 + docker-image|quay.io/argoproj/argocd@v2.12.8 and coreutils@9.4-3ubuntu6
    @@ -3205,7 +3185,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 + docker-image|quay.io/argoproj/argocd@v2.12.8 coreutils@9.4-3ubuntu6 diff --git a/docs/snyk/v2.12.7/redis_7.0.15-alpine.html b/docs/snyk/v2.12.8/redis_7.0.15-alpine.html similarity index 99% rename from docs/snyk/v2.12.7/redis_7.0.15-alpine.html rename to docs/snyk/v2.12.8/redis_7.0.15-alpine.html index 76181d1173f0f..c7a1a3757c771 100644 --- a/docs/snyk/v2.12.7/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.12.8/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      December 8th 2024, 12:26:35 am (UTC+00:00)

      +

      December 15th 2024, 12:27:27 am (UTC+00:00)

      Scanned the following paths: diff --git a/docs/snyk/v2.13.1/argocd-iac-install.html b/docs/snyk/v2.13.2/argocd-iac-install.html similarity index 98% rename from docs/snyk/v2.13.1/argocd-iac-install.html rename to docs/snyk/v2.13.2/argocd-iac-install.html index fc1126512ae00..ab0d42998efdd 100644 --- a/docs/snyk/v2.13.1/argocd-iac-install.html +++ b/docs/snyk/v2.13.2/argocd-iac-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      December 8th 2024, 12:25:26 am (UTC+00:00)

      +

      December 15th 2024, 12:26:19 am (UTC+00:00)

      Scanned the following path: @@ -881,7 +881,7 @@

      Container could be running with outdated image

    • - Line number: 23359 + Line number: 23358
    @@ -933,7 +933,7 @@

    Container could be running with outdated image

  • - Line number: 23658 + Line number: 23657
  • @@ -991,7 +991,7 @@

    Container has no CPU limit

  • - Line number: 22896 + Line number: 22895
  • @@ -1049,7 +1049,7 @@

    Container has no CPU limit

  • - Line number: 23165 + Line number: 23164
  • @@ -1107,7 +1107,7 @@

    Container has no CPU limit

  • - Line number: 23119 + Line number: 23118
  • @@ -1165,7 +1165,7 @@

    Container has no CPU limit

  • - Line number: 23225 + Line number: 23224
  • @@ -1223,7 +1223,7 @@

    Container has no CPU limit

  • - Line number: 23330 + Line number: 23329
  • @@ -1281,7 +1281,7 @@

    Container has no CPU limit

  • - Line number: 23354 + Line number: 23353
  • @@ -1339,7 +1339,7 @@

    Container has no CPU limit

  • - Line number: 23658 + Line number: 23657
  • @@ -1397,7 +1397,7 @@

    Container has no CPU limit

  • - Line number: 23411 + Line number: 23410
  • @@ -1455,7 +1455,7 @@

    Container has no CPU limit

  • - Line number: 23743 + Line number: 23742
  • @@ -1513,7 +1513,7 @@

    Container has no CPU limit

  • - Line number: 24133 + Line number: 24132
  • @@ -1565,7 +1565,7 @@

    Container is running with multiple open ports

  • - Line number: 23145 + Line number: 23144
  • @@ -1617,7 +1617,7 @@

    Container is running without liveness probe

  • - Line number: 22896 + Line number: 22895
  • @@ -1669,7 +1669,7 @@

    Container is running without liveness probe

  • - Line number: 23119 + Line number: 23118
  • @@ -1721,7 +1721,7 @@

    Container is running without liveness probe

  • - Line number: 23330 + Line number: 23329
  • @@ -1779,7 +1779,7 @@

    Container is running without memory limit

  • - Line number: 22896 + Line number: 22895
  • @@ -1837,7 +1837,7 @@

    Container is running without memory limit

  • - Line number: 23119 + Line number: 23118
  • @@ -1895,7 +1895,7 @@

    Container is running without memory limit

  • - Line number: 23165 + Line number: 23164
  • @@ -1953,7 +1953,7 @@

    Container is running without memory limit

  • - Line number: 23225 + Line number: 23224
  • @@ -2011,7 +2011,7 @@

    Container is running without memory limit

  • - Line number: 23330 + Line number: 23329
  • @@ -2069,7 +2069,7 @@

    Container is running without memory limit

  • - Line number: 23354 + Line number: 23353
  • @@ -2127,7 +2127,7 @@

    Container is running without memory limit

  • - Line number: 23658 + Line number: 23657
  • @@ -2185,7 +2185,7 @@

    Container is running without memory limit

  • - Line number: 23411 + Line number: 23410
  • @@ -2243,7 +2243,7 @@

    Container is running without memory limit

  • - Line number: 23743 + Line number: 23742
  • @@ -2301,7 +2301,7 @@

    Container is running without memory limit

  • - Line number: 24133 + Line number: 24132
  • @@ -2357,7 +2357,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23043 + Line number: 23042
  • @@ -2413,7 +2413,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23173 + Line number: 23172
  • @@ -2469,7 +2469,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23148 + Line number: 23147
  • @@ -2525,7 +2525,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23264 + Line number: 23263
  • @@ -2581,7 +2581,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23347 + Line number: 23346
  • @@ -2637,7 +2637,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23361 + Line number: 23360
  • @@ -2693,7 +2693,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23665 + Line number: 23664
  • @@ -2749,7 +2749,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23631 + Line number: 23630
  • @@ -2805,7 +2805,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 24034 + Line number: 24033
  • @@ -2861,7 +2861,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 24352 + Line number: 24351
  • diff --git a/docs/snyk/v2.13.1/argocd-iac-namespace-install.html b/docs/snyk/v2.13.2/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.13.1/argocd-iac-namespace-install.html rename to docs/snyk/v2.13.2/argocd-iac-namespace-install.html index df8e9ecd32933..e9e1a24ff1288 100644 --- a/docs/snyk/v2.13.1/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.13.2/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:25:35 am (UTC+00:00)

    +

    December 15th 2024, 12:26:29 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.12.7/argocd-test.html b/docs/snyk/v2.13.2/argocd-test.html similarity index 80% rename from docs/snyk/v2.12.7/argocd-test.html rename to docs/snyk/v2.13.2/argocd-test.html index 529ca8df39edd..c25d755fd46d7 100644 --- a/docs/snyk/v2.12.7/argocd-test.html +++ b/docs/snyk/v2.13.2/argocd-test.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:25:56 am (UTC+00:00)

    +

    December 15th 2024, 12:24:18 am (UTC+00:00)

    Scanned the following paths: @@ -468,8 +468,8 @@

    Snyk test report

    11 known vulnerabilities
    -
    37 vulnerable dependency paths
    -
    2061 dependencies
    +
    53 vulnerable dependency paths
    +
    2131 dependencies
    @@ -477,12 +477,12 @@

    Snyk test report

    -
    -

    LGPL-3.0 license

    +
    +

    Incorrect Implementation of Authentication Algorithm

    -
    - medium severity +
    + critical severity

    @@ -495,15 +495,15 @@

    LGPL-3.0 license

    Package Manager: golang
  • - Module: + Vulnerable module: - gopkg.in/retry.v1 + golang.org/x/crypto/ssh
  • Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 and golang.org/x/crypto/ssh@0.27.0 - github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others
  • @@ -517,9 +517,241 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/Azure/kubelogin/pkg/token@0.0.20 + golang.org/x/crypto/ssh@0.27.0 + + + + +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 - gopkg.in/retry.v1@1.0.3 + code.gitea.io/sdk/gitea@0.19.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + golang.org/x/crypto/ssh/knownhosts@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + code.gitea.io/sdk/gitea@0.19.0 + + github.com/go-fed/httpsig@1.1.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + code.gitea.io/sdk/gitea@0.19.0 + + golang.org/x/crypto/ssh/agent@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/xanzy/ssh-agent@0.3.3 + + golang.org/x/crypto/ssh/agent@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 + + + +
  • +
  • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + + github.com/go-git/go-git/v5@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/client@5.12.0 + + github.com/go-git/go-git/v5/plumbing/transport/ssh@5.12.0 + + github.com/skeema/knownhosts@1.2.2 + + golang.org/x/crypto/ssh/knownhosts@0.27.0 + + golang.org/x/crypto/ssh@0.27.0 @@ -530,17 +762,31 @@

    Detailed paths


    -

    LGPL-3.0 license

    +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    +
  • -

    Denial of Service (DoS)

    +

    LGPL-3.0 license

    @@ -557,15 +803,15 @@

    Denial of Service (DoS)

    Package Manager: golang
  • - Vulnerable module: + Module: - github.com/rs/cors + gopkg.in/retry.v1
  • Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others + github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others
  • @@ -579,9 +825,9 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 + github.com/Azure/kubelogin/pkg/token@0.0.20 - github.com/rs/cors@1.9.0 + gopkg.in/retry.v1@1.0.3 @@ -592,62 +838,12 @@

    Detailed paths


    -

    Overview

    -

    Affected versions of this package are vulnerable to Denial of Service (DoS) through the processing of malicious preflight requests that include a Access-Control-Request-Headers header with excessive commas. An attacker can induce excessive memory consumption and potentially crash the server by sending specially crafted requests.

    -

    PoC

    -
    
    -        func BenchmarkPreflightAdversarialACRH(b *testing.B) {
    -            resps := makeFakeResponses(b.N)
    -            req, _ := http.NewRequest(http.MethodOptions, dummyEndpoint, nil)
    -            req.Header.Add(headerOrigin, dummyOrigin)
    -            req.Header.Add(headerACRM, http.MethodGet)
    -            req.Header[headerACRH] = adversarialACRH
    -            handler := Default().Handler(testHandler)
    -        
    -            b.ReportAllocs()
    -            b.ResetTimer()
    -            for i := 0; i < b.N; i++ {
    -                handler.ServeHTTP(resps[i], req)
    -            }
    -        }
    -        
    -        var adversarialACRH []string
    -        
    -        func init() { // populates adversarialACRH
    -            n := int(math.Floor(math.Sqrt(http.DefaultMaxHeaderBytes)))
    -            commas := strings.Repeat(",", n)
    -            res := make([]string, n)
    -            for i := range res {
    -                res[i] = commas
    -            }
    -            adversarialACRH = res
    -        }
    -        
    -

    Details

    -

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    -

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    -

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    -

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    -

    Two common types of DoS vulnerabilities:

    -
      -
    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      -
    • -
    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      -
    • -
    -

    Remediation

    -

    Upgrade github.com/rs/cors to version 1.11.0 or higher.

    -

    References

    - +

    LGPL-3.0 license


    @@ -737,7 +933,7 @@

    MPL-2.0 license

  • Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.18.0 and others + github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.19.0 and others
  • @@ -751,7 +947,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - code.gitea.io/sdk/gitea@0.18.0 + code.gitea.io/sdk/gitea@0.19.0 github.com/hashicorp/go-version@1.6.0 @@ -833,7 +1029,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/xanzy/go-gitlab@0.91.1 + github.com/xanzy/go-gitlab@0.109.0 github.com/hashicorp/go-retryablehttp@0.7.7 @@ -1039,7 +1235,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/xanzy/go-gitlab@0.91.1 + github.com/xanzy/go-gitlab@0.109.0 github.com/hashicorp/go-cleanhttp@0.5.2 @@ -1050,7 +1246,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/xanzy/go-gitlab@0.91.1 + github.com/xanzy/go-gitlab@0.109.0 github.com/hashicorp/go-retryablehttp@0.7.7 @@ -1186,7 +1382,7 @@

    MPL-2.0 license

  • Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1 + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.14.0
  • @@ -1201,7 +1397,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/gosimple/slug@1.13.1 + github.com/gosimple/slug@1.14.0 @@ -1506,7 +1702,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 - github.com/bradleyfalzon/ghinstallation/v2@2.6.0 + github.com/bradleyfalzon/ghinstallation/v2@2.11.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1519,7 +1715,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.6.0 + github.com/bradleyfalzon/ghinstallation/v2@2.11.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1534,7 +1730,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.6.0 + github.com/bradleyfalzon/ghinstallation/v2@2.11.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1549,7 +1745,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.6.0 + github.com/bradleyfalzon/ghinstallation/v2@2.11.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1583,7 +1779,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.6.0 + github.com/bradleyfalzon/ghinstallation/v2@2.11.0 github.com/golang-jwt/jwt/v4@4.5.0 @@ -1600,7 +1796,7 @@

    Detailed paths

    github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 - github.com/bradleyfalzon/ghinstallation/v2@2.6.0 + github.com/bradleyfalzon/ghinstallation/v2@2.11.0 github.com/golang-jwt/jwt/v4@4.5.0 diff --git a/docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html b/docs/snyk/v2.13.2/ghcr.io_dexidp_dex_v2.41.1.html similarity index 94% rename from docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html rename to docs/snyk/v2.13.2/ghcr.io_dexidp_dex_v2.41.1.html index 780d8a759cfdd..0c92c0b6203f9 100644 --- a/docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html +++ b/docs/snyk/v2.13.2/ghcr.io_dexidp_dex_v2.41.1.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:23:34 am (UTC+00:00)

    +

    December 15th 2024, 12:24:25 am (UTC+00:00)

    Scanned the following paths: @@ -469,8 +469,8 @@

    Snyk test report

    -
    22 known vulnerabilities
    -
    43 vulnerable dependency paths
    +
    23 known vulnerabilities
    +
    44 vulnerable dependency paths
    969 dependencies
    @@ -479,6 +479,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 /usr/local/bin/gomplate +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v4@* and golang.org/x/crypto/ssh@v0.24.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v4@* + + golang.org/x/crypto/ssh@v0.24.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Insertion of Sensitive Information into Log File

    diff --git a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/v2.13.2/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html similarity index 99% rename from docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html rename to docs/snyk/v2.13.2/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index 509e70d765f11..b539d1cc9fc95 100644 --- a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/v2.13.2/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:26:08 am (UTC+00:00)

    +

    December 15th 2024, 12:24:28 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/v2.13.2/public.ecr.aws_docker_library_redis_7.0.15-alpine.html similarity index 99% rename from docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html rename to docs/snyk/v2.13.2/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index aeee34558fde1..9ad65012ffb57 100644 --- a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/v2.13.2/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    December 8th 2024, 12:23:41 am (UTC+00:00)

    +

    December 15th 2024, 12:24:32 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html b/docs/snyk/v2.13.2/quay.io_argoproj_argocd_v2.13.2.html similarity index 94% rename from docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html rename to docs/snyk/v2.13.2/quay.io_argoproj_argocd_v2.13.2.html index 9b2d11e5b67eb..a5b69352548de 100644 --- a/docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html +++ b/docs/snyk/v2.13.2/quay.io_argoproj_argocd_v2.13.2.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,22 +456,22 @@

    Snyk test report

    -

    December 8th 2024, 12:23:59 am (UTC+00:00)

    +

    December 15th 2024, 12:24:50 am (UTC+00:00)

    Scanned the following paths:
      -
    • quay.io/argoproj/argocd:v2.13.1/argoproj/argocd/Dockerfile (deb)
    • -
    • quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2//usr/local/bin/argocd (gomodules)
    • -
    • quay.io/argoproj/argocd:v2.13.1//usr/local/bin/kustomize (gomodules)
    • -
    • quay.io/argoproj/argocd:v2.13.1/helm/v3//usr/local/bin/helm (gomodules)
    • -
    • quay.io/argoproj/argocd:v2.13.1/git-lfs/git-lfs//usr/bin/git-lfs (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.13.2/argoproj/argocd/Dockerfile (deb)
    • +
    • quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2//usr/local/bin/argocd (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.13.2//usr/local/bin/kustomize (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.13.2/helm/v3//usr/local/bin/helm (gomodules)
    • +
    • quay.io/argoproj/argocd:v2.13.2/git-lfs/git-lfs//usr/bin/git-lfs (gomodules)
    -
    22 known vulnerabilities
    -
    102 vulnerable dependency paths
    +
    23 known vulnerabilities
    +
    103 vulnerable dependency paths
    2354 dependencies
    @@ -480,6 +480,80 @@

    Snyk test report

    +
    +

    Incorrect Implementation of Authentication Algorithm

    +
    + +
    + critical severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd +
    • +
    • + Package Manager: golang +
    • +
    • + Vulnerable module: + + golang.org/x/crypto/ssh +
    • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and golang.org/x/crypto/ssh@v0.27.0 + +
    • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + + golang.org/x/crypto/ssh@v0.27.0 + + + +
    • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/crypto/ssh is a SSH client and server

    +

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate ServerConfig.PublicKeyCallback callbacks.

    +

    Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. It is therefore recommended to rely on the return values of the connection itself, found in ServerConn.Permissions for further authorization steps.

    +

    Remediation

    +

    Upgrade golang.org/x/crypto/ssh to version 0.31.0 or higher.

    +

    References

    + + +
    + + + +

    Insecure Storage of Sensitive Information

    @@ -492,7 +566,7 @@

    Insecure Storage of Sensitive Information

    • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
    • Package Manager: ubuntu:24.04 @@ -505,7 +579,7 @@

      Insecure Storage of Sensitive Information

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and pam/libpam0g@1.5.3-5ubuntu5.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 and pam/libpam0g@1.5.3-5ubuntu5.1
    @@ -518,7 +592,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam0g@1.5.3-5ubuntu5.1 @@ -527,7 +601,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -538,7 +612,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 util-linux@2.39.3-9ubuntu6.1 @@ -549,7 +623,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -564,7 +638,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -581,7 +655,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -600,7 +674,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-modules-bin@1.5.3-5ubuntu5.1 @@ -609,7 +683,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -626,7 +700,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-modules@1.5.3-5ubuntu5.1 @@ -635,7 +709,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -646,7 +720,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -657,7 +731,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -672,7 +746,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -681,7 +755,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -730,7 +804,7 @@

      Improper Authentication

      • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
      • Package Manager: ubuntu:24.04 @@ -743,7 +817,7 @@

        Improper Authentication

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and pam/libpam0g@1.5.3-5ubuntu5.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 and pam/libpam0g@1.5.3-5ubuntu5.1
      @@ -756,7 +830,7 @@

      Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam0g@1.5.3-5ubuntu5.1 @@ -765,7 +839,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -776,7 +850,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 util-linux@2.39.3-9ubuntu6.1 @@ -787,7 +861,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -802,7 +876,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -819,7 +893,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -838,7 +912,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-modules-bin@1.5.3-5ubuntu5.1 @@ -847,7 +921,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -864,7 +938,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-modules@1.5.3-5ubuntu5.1 @@ -873,7 +947,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -884,7 +958,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -895,7 +969,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -910,7 +984,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 pam/libpam-runtime@1.5.3-5ubuntu5.1 @@ -919,7 +993,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 shadow/login@1:4.13+dfsg1-4ubuntu3.2 @@ -966,7 +1040,7 @@

        CVE-2024-26462

        • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
        • Package Manager: ubuntu:24.04 @@ -980,7 +1054,7 @@

          CVE-2024-26462

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.13.2, git@1:2.43.0-1ubuntu7.1 and others
        @@ -992,7 +1066,7 @@

        Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1007,7 +1081,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1024,7 +1098,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1039,7 +1113,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1056,7 +1130,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1075,7 +1149,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1090,7 +1164,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 openssh/openssh-client@1:9.6p1-3ubuntu13.5 @@ -1101,7 +1175,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1114,7 +1188,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1129,7 +1203,7 @@

          Detailed paths

        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 krb5/krb5-locales@1.20.1-6ubuntu2.2 @@ -1174,7 +1248,7 @@

          LGPL-3.0 license

          • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
          • Package Manager: golang @@ -1234,7 +1308,7 @@

            MPL-2.0 license

            • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
            • Package Manager: golang @@ -1294,7 +1368,7 @@

              MPL-2.0 license

              • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
              • Package Manager: golang @@ -1354,7 +1428,7 @@

                MPL-2.0 license

                • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
                • Package Manager: golang @@ -1414,7 +1488,7 @@

                  MPL-2.0 license

                  • - Manifest file: quay.io/argoproj/argocd:v2.13.1/helm/v3 /usr/local/bin/helm + Manifest file: quay.io/argoproj/argocd:v2.13.2/helm/v3 /usr/local/bin/helm
                  • Package Manager: golang @@ -1474,7 +1548,7 @@

                    MPL-2.0 license

                    • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
                    • Package Manager: golang @@ -1534,7 +1608,7 @@

                      MPL-2.0 license

                      • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
                      • Package Manager: golang @@ -1594,7 +1668,7 @@

                        Release of Invalid Pointer or Reference

                        • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                        • Package Manager: ubuntu:24.04 @@ -1607,7 +1681,7 @@

                          Release of Invalid Pointer or Reference

                        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and patch@2.7.6-7build3 + docker-image|quay.io/argoproj/argocd@v2.13.2 and patch@2.7.6-7build3
                        @@ -1620,7 +1694,7 @@

                        Detailed paths

                        • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 patch@2.7.6-7build3 @@ -1664,7 +1738,7 @@

                          Double Free

                          • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                          • Package Manager: ubuntu:24.04 @@ -1677,7 +1751,7 @@

                            Double Free

                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and patch@2.7.6-7build3 + docker-image|quay.io/argoproj/argocd@v2.13.2 and patch@2.7.6-7build3
                          @@ -1690,7 +1764,7 @@

                          Detailed paths

                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 patch@2.7.6-7build3 @@ -1739,7 +1813,7 @@

                            CVE-2024-41996

                            • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                            • Package Manager: ubuntu:24.04 @@ -1752,7 +1826,7 @@

                              CVE-2024-41996

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and openssl/libssl3t64@3.0.13-0ubuntu3.4 + docker-image|quay.io/argoproj/argocd@v2.13.2 and openssl/libssl3t64@3.0.13-0ubuntu3.4
                            @@ -1765,7 +1839,7 @@

                            Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 openssl/libssl3t64@3.0.13-0ubuntu3.4 @@ -1774,7 +1848,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 coreutils@9.4-3ubuntu6 @@ -1785,7 +1859,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 cyrus-sasl2/libsasl2-modules@2.1.28+dfsg1-5ubuntu3.1 @@ -1796,7 +1870,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 libfido2/libfido2-1@1.14.0-1build3 @@ -1807,7 +1881,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 openssh/openssh-client@1:9.6p1-3ubuntu13.5 @@ -1818,7 +1892,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 ca-certificates@20240203 @@ -1831,7 +1905,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1846,7 +1920,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1863,7 +1937,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -1880,7 +1954,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 openssl@3.0.13-0ubuntu3.4 @@ -1889,7 +1963,7 @@

                              Detailed paths

                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 ca-certificates@20240203 @@ -1937,7 +2011,7 @@

                              Information Exposure

                              • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                              • Package Manager: ubuntu:24.04 @@ -1950,7 +2024,7 @@

                                Information Exposure

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and libgcrypt20@1.10.3-2build1 + docker-image|quay.io/argoproj/argocd@v2.13.2 and libgcrypt20@1.10.3-2build1
                              @@ -1963,7 +2037,7 @@

                              Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 libgcrypt20@1.10.3-2build1 @@ -1972,7 +2046,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/dirmngr@2.4.4-2ubuntu17 @@ -1983,7 +2057,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg@2.4.4-2ubuntu17 @@ -1994,7 +2068,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg-agent@2.4.4-2ubuntu17 @@ -2005,7 +2079,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -2018,7 +2092,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -2031,7 +2105,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2044,7 +2118,7 @@

                                Detailed paths

                              • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -2101,7 +2175,7 @@

                                CVE-2024-26458

                                • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                                • Package Manager: ubuntu:24.04 @@ -2115,7 +2189,7 @@

                                  CVE-2024-26458

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.13.2, git@1:2.43.0-1ubuntu7.1 and others
                                @@ -2127,7 +2201,7 @@

                                Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2142,7 +2216,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2159,7 +2233,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2174,7 +2248,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2191,7 +2265,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2210,7 +2284,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2225,7 +2299,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 openssh/openssh-client@1:9.6p1-3ubuntu13.5 @@ -2236,7 +2310,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2249,7 +2323,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2264,7 +2338,7 @@

                                  Detailed paths

                                • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 krb5/krb5-locales@1.20.1-6ubuntu2.2 @@ -2309,7 +2383,7 @@

                                  CVE-2024-26461

                                  • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                                  • Package Manager: ubuntu:24.04 @@ -2323,7 +2397,7 @@

                                    CVE-2024-26461

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.13.2, git@1:2.43.0-1ubuntu7.1 and others
                                  @@ -2335,7 +2409,7 @@

                                  Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2350,7 +2424,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2367,7 +2441,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2382,7 +2456,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2399,7 +2473,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2418,7 +2492,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2433,7 +2507,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 openssh/openssh-client@1:9.6p1-3ubuntu13.5 @@ -2444,7 +2518,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2457,7 +2531,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2472,7 +2546,7 @@

                                    Detailed paths

                                  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 krb5/krb5-locales@1.20.1-6ubuntu2.2 @@ -2517,7 +2591,7 @@

                                    Out-of-bounds Write

                                    • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                                    • Package Manager: ubuntu:24.04 @@ -2530,7 +2604,7 @@

                                      Out-of-bounds Write

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and gnupg2/gpgv@2.4.4-2ubuntu17 + docker-image|quay.io/argoproj/argocd@v2.13.2 and gnupg2/gpgv@2.4.4-2ubuntu17
                                    @@ -2543,7 +2617,7 @@

                                    Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpgv@2.4.4-2ubuntu17 @@ -2552,7 +2626,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 apt@2.7.14build2 @@ -2563,7 +2637,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/dirmngr@2.4.4-2ubuntu17 @@ -2574,7 +2648,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg-agent@2.4.4-2ubuntu17 @@ -2585,7 +2659,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2596,7 +2670,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/dirmngr@2.4.4-2ubuntu17 @@ -2605,7 +2679,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg@2.4.4-2ubuntu17 @@ -2614,7 +2688,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 gnupg2/gpg-agent@2.4.4-2ubuntu17 @@ -2663,7 +2737,7 @@

                                      Allocation of Resources Without Limits or Throttling

                                    • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                                    • Package Manager: ubuntu:24.04 @@ -2676,7 +2750,7 @@

                                      Allocation of Resources Without Limits or Throttling

                                      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and glibc/libc-bin@2.39-0ubuntu8.3 + docker-image|quay.io/argoproj/argocd@v2.13.2 and glibc/libc-bin@2.39-0ubuntu8.3
                                    @@ -2689,7 +2763,7 @@

                                    Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 glibc/libc-bin@2.39-0ubuntu8.3 @@ -2698,7 +2772,7 @@

                                      Detailed paths

                                    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 glibc/libc6@2.39-0ubuntu8.3 @@ -2744,7 +2818,7 @@

                                      Insufficient Documentation of Error Handling Techniques<
                                      • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
                                      • Package Manager: golang @@ -2813,7 +2887,7 @@

                                        Insufficient Documentation of Error Handling Techniques<
                                        • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argo-cd/v2 /usr/local/bin/argocd + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argo-cd/v2 /usr/local/bin/argocd
                                        • Package Manager: golang @@ -2882,7 +2956,7 @@

                                          Improper Input Validation

                                          • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                                          • Package Manager: ubuntu:24.04 @@ -2896,7 +2970,7 @@

                                            Improper Input Validation

                                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1, git@1:2.43.0-1ubuntu7.1 and others + docker-image|quay.io/argoproj/argocd@v2.13.2, git@1:2.43.0-1ubuntu7.1 and others
                                          @@ -2908,7 +2982,7 @@

                                          Detailed paths

                                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2919,7 +2993,7 @@

                                            Detailed paths

                                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git@1:2.43.0-1ubuntu7.1 @@ -2928,7 +3002,7 @@

                                            Detailed paths

                                          • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 git-lfs@3.4.1-1ubuntu0.2 @@ -2975,7 +3049,7 @@

                                            Improper Input Validation

                                            • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd Dockerfile + Manifest file: quay.io/argoproj/argocd:v2.13.2/argoproj/argocd Dockerfile
                                            • Package Manager: ubuntu:24.04 @@ -2988,7 +3062,7 @@

                                              Improper Input Validation

                                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 and coreutils@9.4-3ubuntu6 + docker-image|quay.io/argoproj/argocd@v2.13.2 and coreutils@9.4-3ubuntu6
                                            @@ -3001,7 +3075,7 @@

                                            Detailed paths

                                            • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 + docker-image|quay.io/argoproj/argocd@v2.13.2 coreutils@9.4-3ubuntu6 diff --git a/docs/snyk/v2.13.1/redis_7.0.15-alpine.html b/docs/snyk/v2.13.2/redis_7.0.15-alpine.html similarity index 99% rename from docs/snyk/v2.13.1/redis_7.0.15-alpine.html rename to docs/snyk/v2.13.2/redis_7.0.15-alpine.html index fd80c350ed0d6..1d00ef99b889f 100644 --- a/docs/snyk/v2.13.1/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.13.2/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

                                              Snyk test report

                                              -

                                              December 8th 2024, 12:24:03 am (UTC+00:00)

                                              +

                                              December 15th 2024, 12:24:54 am (UTC+00:00)

                                              Scanned the following paths: diff --git a/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/health.lua b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/health.lua new file mode 100644 index 0000000000000..9cc7edc368b33 --- /dev/null +++ b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/health.lua @@ -0,0 +1,31 @@ +function getStatus(obj) + local hs = {} + hs.status = "Progressing" + hs.message = "Initializing cluster resource set" + + if obj.status ~= nil then + if obj.status.conditions ~= nil then + for i, condition in ipairs(obj.status.conditions) do + + -- Ready + if condition.type == "ResourcesApplied" and condition.status == "True" then + hs.status = "Healthy" + hs.message = "cluster resource set is applied" + return hs + end + + -- Resources Applied + if condition.type == "ResourcesApplied" and condition.status == "False" then + hs.status = "Degraded" + hs.message = condition.message + return hs + end + + end + end + end + return hs +end + +local hs = getStatus(obj) +return hs \ No newline at end of file diff --git a/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/health_test.yaml b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/health_test.yaml new file mode 100644 index 0000000000000..373d143f9bc26 --- /dev/null +++ b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/health_test.yaml @@ -0,0 +1,13 @@ +tests: +- healthStatus: + status: Progressing + message: 'Initializing cluster resource set' + inputPath: testdata/progressing_resourceapplied.yaml +- healthStatus: + status: Degraded + message: 'Failed to apply resources' + inputPath: testdata/degraded_resourceapplied.yaml +- healthStatus: + status: Healthy + message: 'cluster resource set is applied' + inputPath: testdata/healthy_resourceapplied.yaml \ No newline at end of file diff --git a/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/degraded_resourceapplied.yaml b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/degraded_resourceapplied.yaml new file mode 100644 index 0000000000000..ec27b67ed4be5 --- /dev/null +++ b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/degraded_resourceapplied.yaml @@ -0,0 +1,27 @@ +apiVersion: addons.cluster.x-k8s.io/v1beta1 +kind: ClusterResourceSet +metadata: + finalizers: + - addons.cluster.x-k8s.io + generation: 1 + labels: + app.argocd.io/instance: clustername + name: clustername-resource-set + namespace: capi-managed-cluster +spec: + clusterSelector: + matchLabels: + clusterName: clustername + resources: + - kind: ConfigMap + name: clustername-default-rbac + strategy: ApplyOnce +status: + conditions: + - lastTransitionTime: '2024-11-11T03:28:48Z' + message: "Failed to apply resources" + reason: RemoteClusterClientFailed + severity: Error + status: 'False' + type: ResourcesApplied + observedGeneration: 1 diff --git a/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/healthy_resourceapplied.yaml b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/healthy_resourceapplied.yaml new file mode 100644 index 0000000000000..4aaf8c7b36104 --- /dev/null +++ b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/healthy_resourceapplied.yaml @@ -0,0 +1,24 @@ +apiVersion: addons.cluster.x-k8s.io/v1beta1 +kind: ClusterResourceSet +metadata: + finalizers: + - addons.cluster.x-k8s.io + generation: 2 + labels: + app.argocd.io/instance: clustername + name: clustername-resource-set + namespace: capi-managed-cluster +spec: + clusterSelector: + matchLabels: + clusterName: clustername + resources: + - kind: ConfigMap + name: clustername-default-rbac + strategy: ApplyOnce +status: + conditions: + - lastTransitionTime: '2024-11-08T08:49:13Z' + status: 'True' + type: ResourcesApplied + observedGeneration: 2 diff --git a/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/progressing_resourceapplied.yaml b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/progressing_resourceapplied.yaml new file mode 100644 index 0000000000000..f6e499abbc8a6 --- /dev/null +++ b/resource_customizations/addons.cluster.x-k8s.io/ClusterResourceSet/testdata/progressing_resourceapplied.yaml @@ -0,0 +1,18 @@ +apiVersion: addons.cluster.x-k8s.io/v1beta1 +kind: ClusterResourceSet +metadata: + finalizers: + - addons.cluster.x-k8s.io + generation: 2 + labels: + app.argocd.io/instance: clustername + name: clustername-resource-set + namespace: capi-managed-cluster +spec: + clusterSelector: + matchLabels: + clusterName: clustername + resources: + - kind: ConfigMap + name: clustername-default-rbac + strategy: ApplyOnce diff --git a/resource_customizations/platform.confluent.io/Connector/health.lua b/resource_customizations/platform.confluent.io/Connector/health.lua new file mode 100644 index 0000000000000..a800a33179d30 --- /dev/null +++ b/resource_customizations/platform.confluent.io/Connector/health.lua @@ -0,0 +1,25 @@ +hs = {} +if obj.status ~= nil and obj.status.state ~= nil then + if obj.status.state == "CREATED" and obj.status.connectorState == "RUNNING" and obj.status.failedTasksCount == nil then + hs.status = "Healthy" + hs.message = "Connector running" + return hs + end + if obj.status.state == "ERROR" then + hs.status = "Degraded" + if obj.status.conditions and #obj.status.conditions > 0 then + hs.message = obj.status.conditions[1].message -- Kafka Connector only has one condition and nests the issues in the error message here + else + hs.message = "No conditions available" + end + return hs + end + if obj.status.failedTasksCount ~= nil and obj.status.failedTasksCount > 0 then + hs.status = "Degraded" + hs.message = "Connector has failed tasks" + return hs + end +end +hs.status = "Progressing" +hs.message = "Waiting for Kafka Connector" +return hs \ No newline at end of file diff --git a/resource_customizations/platform.confluent.io/Connector/health_test.yaml b/resource_customizations/platform.confluent.io/Connector/health_test.yaml new file mode 100644 index 0000000000000..c449ba98195e1 --- /dev/null +++ b/resource_customizations/platform.confluent.io/Connector/health_test.yaml @@ -0,0 +1,13 @@ +tests: + - healthStatus: + status: Healthy + message: 'Connector running' + inputPath: testdata/connector-healthy.yaml + - healthStatus: + status: Degraded + message: 'connect Rest API request failed: Connector configuration is invalid and contains the following 1 error(s): Could not read properties from file' + inputPath: testdata/connector-failure.yaml + - healthStatus: + status: Degraded + message: 'Connector has failed tasks' + inputPath: testdata/connector-task-failure.yaml \ No newline at end of file diff --git a/resource_customizations/platform.confluent.io/Connector/testdata/connector-failure.yaml b/resource_customizations/platform.confluent.io/Connector/testdata/connector-failure.yaml new file mode 100644 index 0000000000000..b34a297bbabb9 --- /dev/null +++ b/resource_customizations/platform.confluent.io/Connector/testdata/connector-failure.yaml @@ -0,0 +1,27 @@ +apiVersion: platform.confluent.io/v1beta1 +kind: Connector +metadata: + finalizers: + - connect.finalizers.platform.confluent.io + generation: 1 + name: connect + namespace: confluent +spec: + class: io.confluent.connect.sftp.SftpSinkConnector + configs: + topics: test-topic + connectClusterRef: + name: connect + name: test-sftp-connector + taskMax: 3 +status: + appState: Failed + conditions: + - lastProbeTime: '2024-04-02T07:43:35Z' + lastTransitionTime: '2024-04-02T07:43:35Z' + message: >- + connect Rest API request failed: Connector configuration is invalid and contains the following 1 error(s): Could not read properties from file + reason: CreateFailed + status: 'False' + type: platform.confluent.io/app-ready + state: ERROR \ No newline at end of file diff --git a/resource_customizations/platform.confluent.io/Connector/testdata/connector-healthy.yaml b/resource_customizations/platform.confluent.io/Connector/testdata/connector-healthy.yaml new file mode 100644 index 0000000000000..10df701b7c53e --- /dev/null +++ b/resource_customizations/platform.confluent.io/Connector/testdata/connector-healthy.yaml @@ -0,0 +1,31 @@ +apiVersion: platform.confluent.io/v1beta1 +kind: Connector +metadata: + finalizers: + - connect.finalizers.platform.confluent.io + generation: 1 + name: connect + namespace: confluent +spec: + class: io.confluent.connect.sftp.SftpSinkConnector + configs: + topics: test-topic + connectClusterRef: + name: connect + name: test-sftp-connector + taskMax: 3 +status: + appState: Created + conditions: + - lastProbeTime: '2024-04-02T07:43:35Z' + lastTransitionTime: '2024-04-02T07:43:35Z' + message: Application is created + reason: Created + status: 'True' + type: platform.confluent.io/app-ready + connectorState: RUNNING + restartPolicy: + maxRetry: 10 + type: OnFailure + state: CREATED + tasksReady: 3/3 \ No newline at end of file diff --git a/resource_customizations/platform.confluent.io/Connector/testdata/connector-task-failure.yaml b/resource_customizations/platform.confluent.io/Connector/testdata/connector-task-failure.yaml new file mode 100644 index 0000000000000..09134a48f41b2 --- /dev/null +++ b/resource_customizations/platform.confluent.io/Connector/testdata/connector-task-failure.yaml @@ -0,0 +1,37 @@ +apiVersion: platform.confluent.io/v1beta1 +kind: Connector +metadata: + finalizers: + - connect.finalizers.platform.confluent.io + generation: 1 + name: connect + namespace: confluent +spec: + class: io.confluent.connect.sftp.SftpSinkConnector + configs: + topics: test-topic + connectClusterRef: + name: connect + name: test-sftp-connector + taskMax: 3 +status: + appState: Unknown + conditions: + - lastProbeTime: '2024-01-19T06:42:40Z' + lastTransitionTime: '2024-01-19T06:42:40Z' + message: Application is created + reason: Created + status: 'True' + type: platform.confluent.io/app-ready + connectorState: RUNNING + failedTasks: + task-0: + id: 0 + retryCount: 10 + failedTasksCount: 1 + observedGeneration: 1 + restartPolicy: + maxRetry: 10 + type: OnFailure + state: CREATED + tasksReady: 0/1 \ No newline at end of file diff --git a/server/application/logs.go b/server/application/logs.go index 778f04edec66e..b52eef81e2e77 100644 --- a/server/application/logs.go +++ b/server/application/logs.go @@ -120,16 +120,22 @@ func mergeLogStreams(streams []chan logEntry, bufferingDuration time.Duration) c var sentAt time.Time ticker := time.NewTicker(bufferingDuration) + done := make(chan struct{}) go func() { - for range ticker.C { - sentAtLock.Lock() - // waited long enough for logs from each streams, send everything accumulated - if sentAt.Add(bufferingDuration).Before(time.Now()) { - _ = send(true) - sentAt = time.Now() - } + for { + select { + case <-done: + return + case <-ticker.C: + sentAtLock.Lock() + // waited long enough for logs from each streams, send everything accumulated + if sentAt.Add(bufferingDuration).Before(time.Now()) { + _ = send(true) + sentAt = time.Now() + } - sentAtLock.Unlock() + sentAtLock.Unlock() + } } }() @@ -145,6 +151,11 @@ func mergeLogStreams(streams []chan logEntry, bufferingDuration time.Duration) c _ = send(true) ticker.Stop() + // ticker.Stop() does not close the channel, and it does not wait for the channel to be drained. So we need to + // explicitly prevent the gorountine from leaking by closing the channel. We also need to prevent the goroutine + // from calling `send` again, because `send` pushes to the `merged` channel which we're about to close. + // This describes the approach nicely: https://stackoverflow.com/questions/17797754/ticker-stop-behaviour-in-golang + done <- struct{}{} close(merged) }() return merged diff --git a/server/application/logs_test.go b/server/application/logs_test.go index 76bd5df134ae9..7a565e37efa79 100644 --- a/server/application/logs_test.go +++ b/server/application/logs_test.go @@ -75,3 +75,33 @@ func TestMergeLogStreams(t *testing.T) { assert.Equal(t, []string{"1", "2", "3", "4"}, lines) } + +func TestMergeLogStreams_RaceCondition(t *testing.T) { + // Test for regression of this issue: https://github.com/argoproj/argo-cd/issues/7006 + for i := 0; i < 5000; i++ { + first := make(chan logEntry) + second := make(chan logEntry) + + go func() { + parseLogsStream("first", io.NopCloser(strings.NewReader(`2021-02-09T00:00:01Z 1`)), first) + time.Sleep(time.Duration(i%3) * time.Millisecond) + close(first) + }() + + go func() { + parseLogsStream("second", io.NopCloser(strings.NewReader(`2021-02-09T00:00:02Z 2`)), second) + time.Sleep(time.Duration((i+1)%3) * time.Millisecond) + close(second) + }() + + merged := mergeLogStreams([]chan logEntry{first, second}, 1*time.Millisecond) + + // Drain the channel + for range merged { + } + + // This test intentionally doesn't test the order of the output. Under these intense conditions, the test would + // fail often due to out of order entries. This test is only meant to reproduce a race between a channel writer + // and channel closer. + } +}