diff --git a/CODEOWNERS b/CODEOWNERS index 507193dad5611..ec72eccbf416e 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -2,8 +2,9 @@ ** @argoproj/argocd-approvers # Docs -/docs/** @argoproj/argocd-approvers @argoproj/argocd-approvers-docs -/USERS.md @argoproj/argocd-approvers @argoproj/argocd-approvers-docs +/docs/** @argoproj/argocd-approvers @argoproj/argocd-approvers-docs +/USERS.md @argoproj/argocd-approvers @argoproj/argocd-approvers-docs +/mkdocs.yml @argoproj/argocd-approvers @argoproj/argocd-approvers-docs # CI /.github/** @argoproj/argocd-approvers @argoproj/argocd-approvers-ci diff --git a/cmd/argocd/commands/admin/project_allowlist.go b/cmd/argocd/commands/admin/project_allowlist.go index 57b855251daa9..460ea21d93329 100644 --- a/cmd/argocd/commands/admin/project_allowlist.go +++ b/cmd/argocd/commands/admin/project_allowlist.go @@ -41,6 +41,8 @@ func NewProjectAllowListGenCommand() *cobra.Command { var command = &cobra.Command{ Use: "generate-allow-list CLUSTERROLE_PATH PROJ_NAME", Short: "Generates project allow list from the specified clusterRole file", + Example: `# Generates project allow list from the specified clusterRole file +argocd admin proj generate-allow-list /path/to/clusterrole.yaml my-project`, Run: func(c *cobra.Command, args []string) { if len(args) != 2 { c.HelpFunc()(c, args) diff --git a/cmd/argocd/commands/admin/settings_rbac.go b/cmd/argocd/commands/admin/settings_rbac.go index 8d94feeaad466..1c09fa0d1cfe7 100644 --- a/cmd/argocd/commands/admin/settings_rbac.go +++ b/cmd/argocd/commands/admin/settings_rbac.go @@ -189,7 +189,6 @@ argocd admin settings rbac can someuser create application 'default/app' --defau } }, } - clientConfig = cli.AddKubectlFlagsToCmd(command) command.Flags().StringVar(&policyFile, "policy-file", "", "path to the policy file to use") command.Flags().StringVar(&defaultRole, "default-role", "", "name of the default role to use") @@ -202,24 +201,55 @@ argocd admin settings rbac can someuser create application 'default/app' --defau // NewRBACValidateCommand returns a new rbac validate command func NewRBACValidateCommand() *cobra.Command { var ( - policyFile string + policyFile string + namespace string + clientConfig clientcmd.ClientConfig ) var command = &cobra.Command{ - Use: "validate --policy-file=POLICYFILE", + Use: "validate [--policy-file POLICYFILE] [--namespace NAMESPACE]", Short: "Validate RBAC policy", Long: ` Validates an RBAC policy for being syntactically correct. The policy must be -a local file, and in either CSV or K8s ConfigMap format. +a local file or a K8s ConfigMap in the provided namespace, and in either CSV or K8s ConfigMap format. +`, + Example: ` +# Check whether a given policy file is valid using a local policy.csv file. +argocd admin settings rbac validate --policy-file policy.csv + +# Policy file can also be K8s config map with data keys like argocd-rbac-cm, +# i.e. 'policy.csv' and (optionally) 'policy.default' +argocd admin settings rbac validate --policy-file argocd-rbac-cm.yaml + +# If --policy-file is not given, and instead --namespace is giventhe ConfigMap 'argocd-rbac-cm' +# from K8s is used. +argocd admin settings rbac validate --namespace argocd + +# Either --policy-file or --namespace must be given. `, Run: func(c *cobra.Command, args []string) { ctx := c.Context() - if policyFile == "" { + if len(args) > 0 { c.HelpFunc()(c, args) - log.Fatalf("Please specify policy to validate using --policy-file") + log.Fatalf("too many arguments") + } + + if (namespace == "" && policyFile == "") || (namespace != "" && policyFile != "") { + c.HelpFunc()(c, args) + log.Fatalf("please provide exactly one of --policy-file or --namespace") } - userPolicy, _, _ := getPolicy(ctx, policyFile, nil, "") + + restConfig, err := clientConfig.ClientConfig() + if err != nil { + log.Fatalf("could not get config to create k8s client: %v", err) + } + realClientset, err := kubernetes.NewForConfig(restConfig) + if err != nil { + log.Fatalf("could not create k8s client: %v", err) + } + + userPolicy, _, _ := getPolicy(ctx, policyFile, realClientset, namespace) if userPolicy != "" { if err := rbac.ValidatePolicy(userPolicy); err == nil { fmt.Printf("Policy is valid.\n") @@ -228,11 +258,15 @@ a local file, and in either CSV or K8s ConfigMap format. fmt.Printf("Policy is invalid: %v\n", err) os.Exit(1) } + } else { + log.Fatalf("Policy is empty or could not be loaded.") } }, } - + clientConfig = cli.AddKubectlFlagsToCmd(command) command.Flags().StringVar(&policyFile, "policy-file", "", "path to the policy file to use") + command.Flags().StringVar(&namespace, "namespace", "", "namespace to get argo rbac configmap from") + return command } diff --git a/cmd/argocd/commands/admin/settings_rbac_test.go b/cmd/argocd/commands/admin/settings_rbac_test.go index a4b4b437e114c..79835ffd0c14d 100644 --- a/cmd/argocd/commands/admin/settings_rbac_test.go +++ b/cmd/argocd/commands/admin/settings_rbac_test.go @@ -5,15 +5,42 @@ import ( "os" "testing" + "github.com/argoproj/argo-cd/v2/util/assets" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/client-go/kubernetes/fake" - - "github.com/argoproj/argo-cd/v2/util/assets" + restclient "k8s.io/client-go/rest" + "k8s.io/client-go/tools/clientcmd" + clientcmdapi "k8s.io/client-go/tools/clientcmd/api" ) +type FakeClientConfig struct { + clientConfig clientcmd.ClientConfig +} + +func NewFakeClientConfig(clientConfig clientcmd.ClientConfig) *FakeClientConfig { + return &FakeClientConfig{clientConfig: clientConfig} +} + +func (f *FakeClientConfig) RawConfig() (clientcmdapi.Config, error) { + config, err := f.clientConfig.RawConfig() + return config, err +} + +func (f *FakeClientConfig) ClientConfig() (*restclient.Config, error) { + return f.clientConfig.ClientConfig() +} + +func (f *FakeClientConfig) Namespace() (string, bool, error) { + return f.clientConfig.Namespace() +} + +func (f *FakeClientConfig) ConfigAccess() clientcmd.ConfigAccess { + return nil +} + func Test_isValidRBACAction(t *testing.T) { for k := range validRBACActions { t.Run(k, func(t *testing.T) { @@ -200,3 +227,19 @@ p, role:, certificates, get, .*, allow` require.True(t, ok) }) } + +func TestNewRBACCanCommand(t *testing.T) { + command := NewRBACCanCommand() + + require.NotNil(t, command) + assert.Equal(t, "can", command.Name()) + assert.Equal(t, "Check RBAC permissions for a role or subject", command.Short) +} + +func TestNewRBACValidateCommand(t *testing.T) { + command := NewRBACValidateCommand() + + require.NotNil(t, command) + assert.Equal(t, "validate", command.Name()) + assert.Equal(t, "Validate RBAC policy", command.Short) +} diff --git a/cmd/argocd/commands/gpg.go b/cmd/argocd/commands/gpg.go index 3c0496d2f012a..73768fc18a324 100644 --- a/cmd/argocd/commands/gpg.go +++ b/cmd/argocd/commands/gpg.go @@ -43,6 +43,17 @@ func NewGPGListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command { var command = &cobra.Command{ Use: "list", Short: "List configured GPG public keys", + Example: templates.Examples(` + # List all configured GPG public keys in wide format (default). + argocd gpg list + + # List all configured GPG public keys in JSON format. + argocd gpg list -o json + + # List all configured GPG public keys in YAML format. + argocd gpg list -o yaml + `), + Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -73,6 +84,17 @@ func NewGPGGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command { var command = &cobra.Command{ Use: "get KEYID", Short: "Get the GPG public key with ID from the server", + Example: templates.Examples(` + # Get a GPG public key with the specified KEYID in wide format (default). + argocd gpg get KEYID + + # Get a GPG public key with the specified KEYID in JSON format. + argocd gpg get KEYID -o json + + # Get a GPG public key with the specified KEYID in YAML format. + argocd gpg get KEYID -o yaml + `), + Run: func(c *cobra.Command, args []string) { ctx := c.Context() diff --git a/cmd/argocd/commands/project_role.go b/cmd/argocd/commands/project_role.go index 8dca406a9dc30..5920bac0dc8e4 100644 --- a/cmd/argocd/commands/project_role.go +++ b/cmd/argocd/commands/project_role.go @@ -57,6 +57,30 @@ func NewProjectRoleAddPolicyCommand(clientOpts *argocdclient.ClientOptions) *cob var command = &cobra.Command{ Use: "add-policy PROJECT ROLE-NAME", Short: "Add a policy to a project role", + Example: `# Before adding new policy +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (3 hours ago) + +# Add a new policy to allow update to the project +$ argocd proj role add-policy test-project test-role -a update -p allow -o project + +# Policy should be updated +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +p, proj:test-project:test-role, applications, update, test-project/project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (3 hours ago) +`, Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -94,6 +118,30 @@ func NewProjectRoleRemovePolicyCommand(clientOpts *argocdclient.ClientOptions) * var command = &cobra.Command{ Use: "remove-policy PROJECT ROLE-NAME", Short: "Remove a policy from a role within a project", + Example: `List the policy of the test-role before removing a policy +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +p, proj:test-project:test-role, applications, update, test-project/project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (3 hours ago) + +# Remove the policy to allow update to objects +$ argocd proj role remove-policy test-project test-role -a update -p allow -o project + +# The role should be removed now. +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (4 hours ago) +`, Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -141,6 +189,11 @@ func NewProjectRoleCreateCommand(clientOpts *argocdclient.ClientOptions) *cobra. var command = &cobra.Command{ Use: "create PROJECT ROLE-NAME", Short: "Create a project role", + Example: templates.Examples(` + # Create a project role in the "my-project" project with the name "my-role". + argocd proj role create my-project my-role --description "My project role description" + `), + Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -175,13 +228,9 @@ func NewProjectRoleCreateCommand(clientOpts *argocdclient.ClientOptions) *cobra. // NewProjectRoleDeleteCommand returns a new instance of an `argocd proj role delete` command func NewProjectRoleDeleteCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command { var command = &cobra.Command{ - Use: "delete PROJECT ROLE-NAME", - Short: "Delete a project role", - Example: templates.Examples(` - # Delete a project role from the "my-project" project with the name "my-role". - argocd proj role delete my-project my-role - `), - + Use: "delete PROJECT ROLE-NAME", + Short: "Delete a project role", + Example: `$ argocd proj role delete test-project test-role`, Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -229,8 +278,15 @@ func NewProjectRoleCreateTokenCommand(clientOpts *argocdclient.ClientOptions) *c tokenID string ) var command = &cobra.Command{ - Use: "create-token PROJECT ROLE-NAME", - Short: "Create a project token", + Use: "create-token PROJECT ROLE-NAME", + Short: "Create a project token", + Example: `$ argocd proj role create-token test-project test-role +Create token succeeded for proj:test-project:test-role. + ID: f316c466-40bd-4cfd-8a8c-1392e92255d4 + Issued At: 2023-10-08T15:21:40+01:00 + Expires At: Never + Token: xxx +`, Aliases: []string{"token-create"}, Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -294,8 +350,13 @@ func NewProjectRoleListTokensCommand(clientOpts *argocdclient.ClientOptions) *co useUnixTime bool ) var command = &cobra.Command{ - Use: "list-tokens PROJECT ROLE-NAME", - Short: "List tokens for a given role.", + Use: "list-tokens PROJECT ROLE-NAME", + Short: "List tokens for a given role.", + Example: `$ argocd proj role list-tokens test-project test-role +ID ISSUED AT EXPIRES AT +f316c466-40bd-4cfd-8a8c-1392e92255d4 2023-10-08T15:21:40+01:00 Never +fa9d3517-c52d-434c-9bff-215b38508842 2023-10-08T11:08:18+01:00 Never +`, Aliases: []string{"list-token", "token-list"}, Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -345,8 +406,35 @@ func NewProjectRoleListTokensCommand(clientOpts *argocdclient.ClientOptions) *co // NewProjectRoleDeleteTokenCommand returns a new instance of an `argocd proj role delete-token` command func NewProjectRoleDeleteTokenCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command { var command = &cobra.Command{ - Use: "delete-token PROJECT ROLE-NAME ISSUED-AT", - Short: "Delete a project token", + Use: "delete-token PROJECT ROLE-NAME ISSUED-AT", + Short: "Delete a project token", + Example: `#Create project test-project +$ argocd proj create test-project + +# Create a role associated with test-project +$ argocd proj role create test-project test-role +Role 'test-role' created + +# Create test-role associated with test-project +$ argocd proj role create-token test-project test-role +Create token succeeded for proj:test-project:test-role. + ID: c312450e-12e1-4e0d-9f65-fac9cb027b32 + Issued At: 2023-10-08T13:58:57+01:00 + Expires At: Never + Token: xxx + +# Get test-role id to input into the delete-token command below +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696769937 2023-10-08T13:58:57+01:00 (6 minutes ago) + +$ argocd proj role delete-token test-project test-role 1696769937 +`, Aliases: []string{"token-delete", "remove-token"}, Run: func(c *cobra.Command, args []string) { ctx := c.Context() @@ -439,6 +527,16 @@ func NewProjectRoleGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Com var command = &cobra.Command{ Use: "get PROJECT ROLE-NAME", Short: "Get the details of a specific role", + Example: `$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696774900 2023-10-08T15:21:40+01:00 (4 minutes ago) +1696759698 2023-10-08T11:08:18+01:00 (4 hours ago) +`, Run: func(c *cobra.Command, args []string) { ctx := c.Context() diff --git a/docs/assets/identity-center-1.png b/docs/assets/identity-center-1.png new file mode 100644 index 0000000000000..0cd49528d90f7 Binary files /dev/null and b/docs/assets/identity-center-1.png differ diff --git a/docs/assets/identity-center-2.png b/docs/assets/identity-center-2.png new file mode 100644 index 0000000000000..5a96899193168 Binary files /dev/null and b/docs/assets/identity-center-2.png differ diff --git a/docs/assets/identity-center-3.png b/docs/assets/identity-center-3.png new file mode 100644 index 0000000000000..79414b119d335 Binary files /dev/null and b/docs/assets/identity-center-3.png differ diff --git a/docs/assets/identity-center-4.png b/docs/assets/identity-center-4.png new file mode 100644 index 0000000000000..fbe48e4400974 Binary files /dev/null and b/docs/assets/identity-center-4.png differ diff --git a/docs/assets/identity-center-5.png b/docs/assets/identity-center-5.png new file mode 100644 index 0000000000000..f170c8d5069e0 Binary files /dev/null and b/docs/assets/identity-center-5.png differ diff --git a/docs/assets/identity-center-6.png b/docs/assets/identity-center-6.png new file mode 100644 index 0000000000000..01fe6f73f0642 Binary files /dev/null and b/docs/assets/identity-center-6.png differ diff --git a/docs/operator-manual/applicationset/Appset-Any-Namespace.md b/docs/operator-manual/applicationset/Appset-Any-Namespace.md index 61716414aeb69..bf3f8ffecfaf1 100644 --- a/docs/operator-manual/applicationset/Appset-Any-Namespace.md +++ b/docs/operator-manual/applicationset/Appset-Any-Namespace.md @@ -35,6 +35,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - scmProvider: gitea: @@ -137,17 +139,19 @@ metadata: name: team-one-product-one namespace: team-one-cd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: list: - - id: infra + - name: infra project: infra-project - - id: team-two + - name: team-two project: team-two-project - template: - metadata: - name: '{{name}}-escalation' - spec: - project: "{{project}}" + template: + metadata: + name: '{{.name}}-escalation' + spec: + project: "{{.project}}" ``` ### ApplicationSet names diff --git a/docs/operator-manual/applicationset/Generators-Cluster-Decision-Resource.md b/docs/operator-manual/applicationset/Generators-Cluster-Decision-Resource.md index 8f5bb491b8b44..44567884dccf8 100644 --- a/docs/operator-manual/applicationset/Generators-Cluster-Decision-Resource.md +++ b/docs/operator-manual/applicationset/Generators-Cluster-Decision-Resource.md @@ -8,6 +8,8 @@ metadata: name: guestbook namespace: argocd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - clusterDecisionResource: # ConfigMap with GVK information for the duck type resource @@ -26,7 +28,7 @@ spec: requeueAfterSeconds: 60 template: metadata: - name: '{{name}}-guestbook' + name: '{{.name}}-guestbook' spec: project: "default" source: @@ -34,7 +36,7 @@ spec: targetRevision: HEAD path: guestbook destination: - server: '{{clusterName}}' # 'server' field of the secret + server: '{{.clusterName}}' # 'server' field of the secret namespace: guestbook ``` The `quak` resource, referenced by the ApplicationSet `clusterDecisionResource` generator: diff --git a/docs/operator-manual/applicationset/Generators-Cluster.md b/docs/operator-manual/applicationset/Generators-Cluster.md index 92507645a4ffe..ca1a49aad295b 100644 --- a/docs/operator-manual/applicationset/Generators-Cluster.md +++ b/docs/operator-manual/applicationset/Generators-Cluster.md @@ -39,11 +39,13 @@ metadata: name: guestbook namespace: argocd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - clusters: {} # Automatically use all clusters defined within Argo CD template: metadata: - name: '{{name}}-guestbook' # 'name' field of the Secret + name: '{{.name}}-guestbook' # 'name' field of the Secret spec: project: "my-project" source: @@ -51,7 +53,7 @@ spec: targetRevision: HEAD path: guestbook destination: - server: '{{server}}' # 'server' field of the secret + server: '{{.server}}' # 'server' field of the secret namespace: guestbook ``` (*The full example can be found [here](https://github.com/argoproj/argo-cd/tree/master/applicationset/examples/cluster).*) @@ -67,6 +69,8 @@ metadata: name: guestbook namespace: argocd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - clusters: selector: @@ -105,6 +109,8 @@ The cluster generator will automatically target both local and non-local cluster If you wish to target only remote clusters with your Applications (e.g. you want to exclude the local cluster), then use a cluster selector with labels, for example: ```yaml spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - clusters: selector: @@ -137,6 +143,8 @@ You may pass additional, arbitrary string key-value pairs via the `values` field In this example, a `revision` parameter value is passed, based on matching labels on the cluster secret: ```yaml spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - clusters: selector: @@ -154,16 +162,16 @@ spec: revision: stable template: metadata: - name: '{{name}}-guestbook' + name: '{{.name}}-guestbook' spec: project: "my-project" source: repoURL: https://github.com/argoproj/argocd-example-apps/ # The cluster values field for each generator will be substituted here: - targetRevision: '{{values.revision}}' + targetRevision: '{{.values.revision}}' path: guestbook destination: - server: '{{server}}' + server: '{{.server}}' namespace: guestbook ``` @@ -184,6 +192,8 @@ Extending the example above, we could do something like this: ```yaml spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - clusters: selector: @@ -192,8 +202,8 @@ spec: # A key-value map for arbitrary parameters values: # If `my-custom-annotation` is in your cluster secret, `revision` will be substituted with it. - revision: '{{metadata.annotations.my-custom-annotation}}' - clusterName: '{{name}}' + revision: '{{index .metadata.annotations "my-custom-annotation"}}' + clusterName: '{{.name}}' - clusters: selector: matchLabels: @@ -201,19 +211,19 @@ spec: values: # production uses a different revision value, for 'stable' branch revision: stable - clusterName: '{{name}}' + clusterName: '{{.name}}' template: metadata: - name: '{{name}}-guestbook' + name: '{{.name}}-guestbook' spec: project: "my-project" source: repoURL: https://github.com/argoproj/argocd-example-apps/ # The cluster values field for each generator will be substituted here: - targetRevision: '{{values.revision}}' + targetRevision: '{{.values.revision}}' path: guestbook destination: # In this case this is equivalent to just using {{name}} - server: '{{values.clusterName}}' + server: '{{.values.clusterName}}' namespace: guestbook ``` diff --git a/docs/operator-manual/applicationset/Generators-Git.md b/docs/operator-manual/applicationset/Generators-Git.md index 1dcd85ea24b2a..24fb3427d73b0 100644 --- a/docs/operator-manual/applicationset/Generators-Git.md +++ b/docs/operator-manual/applicationset/Generators-Git.md @@ -210,6 +210,8 @@ metadata: name: cluster-addons namespace: argocd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - git: repoURL: https://github.com/example/example-repo.git @@ -217,19 +219,19 @@ spec: directories: - path: '*' values: - cluster: '{{branch}}-{{path}}' + cluster: '{{.branch}}-{{.path.basename}}' template: metadata: - name: '{{path.basename}}' + name: '{{.path.basename}}' spec: project: "my-project" source: repoURL: https://github.com/example/example-repo.git targetRevision: HEAD - path: '{{path}}' + path: '{{.path.path}}' destination: server: https://kubernetes.default.svc - namespace: '{{values.cluster}}' + namespace: '{{.values.cluster}}' ``` !!! note @@ -323,15 +325,15 @@ As with other generators, clusters *must* already be defined within Argo CD, in In addition to the flattened key/value pairs from the configuration file, the following generator parameters are provided: -- `{{path}}`: The path to the directory containing matching configuration file within the Git repository. Example: `/clusters/clusterA`, if the config file was `/clusters/clusterA/config.json` -- `{{path[n]}}`: The path to the matching configuration file within the Git repository, split into array elements (`n` - array index). Example: `path[0]: clusters`, `path[1]: clusterA` -- `{{path.basename}}`: Basename of the path to the directory containing the configuration file (e.g. `clusterA`, with the above example.) -- `{{path.basenameNormalized}}`: This field is the same as `path.basename` with unsupported characters replaced with `-` (e.g. a `path` of `/directory/directory_2`, and `path.basename` of `directory_2` would produce `directory-2` here). -- `{{path.filename}}`: The matched filename. e.g., `config.json` in the above example. -- `{{path.filenameNormalized}}`: The matched filename with unsupported characters replaced with `-`. +- `{{.path.path}}`: The path to the directory containing matching configuration file within the Git repository. Example: `/clusters/clusterA`, if the config file was `/clusters/clusterA/config.json` +- `{{index .path n}}`: The path to the matching configuration file within the Git repository, split into array elements (`n` - array index). Example: `index .path 0: clusters`, `index .path 1: clusterA` +- `{{.path.basename}}`: Basename of the path to the directory containing the configuration file (e.g. `clusterA`, with the above example.) +- `{{.path.basenameNormalized}}`: This field is the same as `.path.basename` with unsupported characters replaced with `-` (e.g. a `path` of `/directory/directory_2`, and `.path.basename` of `directory_2` would produce `directory-2` here). +- `{{.path.filename}}`: The matched filename. e.g., `config.json` in the above example. +- `{{.path.filenameNormalized}}`: The matched filename with unsupported characters replaced with `-`. -**Note**: The right-most *directory* name always becomes `{{path.basename}}`. For example, from `- path: /one/two/three/four/config.json`, `{{path.basename}}` will be `four`. -The filename can always be accessed using `{{path.filename}}`. +**Note**: The right-most *directory* name always becomes `{{.path.basename}}`. For example, from `- path: /one/two/three/four/config.json`, `{{.path.basename}}` will be `four`. +The filename can always be accessed using `{{.path.filename}}`. **Note**: If the `pathParamPrefix` option is specified, all `path`-related parameter names above will be prefixed with the specified value and a dot separator. E.g., if `pathParamPrefix` is `myRepo`, then the generated parameter name would be `myRepo.path` instead of `path`. Using this option is necessary in a Matrix generator where both child generators are Git generators (to avoid conflicts when merging the child generators’ items). @@ -349,6 +351,8 @@ metadata: name: guestbook namespace: argocd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - git: repoURL: https://github.com/argoproj/argo-cd.git @@ -356,18 +360,18 @@ spec: files: - path: "applicationset/examples/git-generator-files-discovery/cluster-config/**/config.json" values: - base_dir: "{{path[0]}}/{{path[1]}}/{{path[2]}}" + base_dir: "{{index .path 0}}/{{index .path 1}}/{{index .path 2}}" template: metadata: - name: '{{cluster.name}}-guestbook' + name: '{{.cluster.name}}-guestbook' spec: project: default source: repoURL: https://github.com/argoproj/argo-cd.git targetRevision: HEAD - path: "{{values.base_dir}}/apps/guestbook" + path: "{{.values.base_dir}}/apps/guestbook" destination: - server: '{{cluster.address}}' + server: '{{.cluster.address}}' namespace: guestbook ``` diff --git a/docs/operator-manual/applicationset/Generators-List.md b/docs/operator-manual/applicationset/Generators-List.md index a99229f858da4..e5696f37b9745 100644 --- a/docs/operator-manual/applicationset/Generators-List.md +++ b/docs/operator-manual/applicationset/Generators-List.md @@ -8,25 +8,26 @@ metadata: name: guestbook namespace: argocd spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - list: elements: - cluster: engineering-dev url: https://kubernetes.default.svc -# - cluster: engineering-prod -# url: https://kubernetes.default.svc -# foo: bar + - cluster: engineering-prod + url: https://kubernetes.default.svc template: metadata: - name: '{{cluster}}-guestbook' + name: '{{.cluster}}-guestbook' spec: project: "my-project" source: repoURL: https://github.com/argoproj/argo-cd.git targetRevision: HEAD - path: applicationset/examples/list-generator/guestbook/{{cluster}} + path: applicationset/examples/list-generator/guestbook/{{.cluster}} destination: - server: '{{url}}' + server: '{{.url}}' namespace: guestbook ``` (*The full example can be found [here](https://github.com/argoproj/argo-cd/tree/master/applicationset/examples/list-generator).*) diff --git a/docs/operator-manual/applicationset/Generators-Matrix.md b/docs/operator-manual/applicationset/Generators-Matrix.md index 6684cdc90f73b..0396b8c0e06d3 100644 --- a/docs/operator-manual/applicationset/Generators-Matrix.md +++ b/docs/operator-manual/applicationset/Generators-Matrix.md @@ -35,6 +35,8 @@ kind: ApplicationSet metadata: name: cluster-git spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: # matrix 'parent' generator - matrix: @@ -52,16 +54,16 @@ spec: argocd.argoproj.io/secret-type: cluster template: metadata: - name: '{{path.basename}}-{{name}}' + name: '{{.path.basename}}-{{.name}}' spec: - project: '{{metadata.labels.environment}}' + project: '{{index .metadata.labels "environment"}}' source: repoURL: https://github.com/argoproj/argo-cd.git targetRevision: HEAD - path: '{{path}}' + path: '{{.path.path}}' destination: - server: '{{server}}' - namespace: '{{path.basename}}' + server: '{{.server}}' + namespace: '{{.path.basename}}' ``` First, the Git directory generator will scan the Git repository, discovering directories under the specified path. It discovers the argo-workflows and prometheus-operator applications, and produces two corresponding sets of parameters: @@ -117,6 +119,8 @@ kind: ApplicationSet metadata: name: cluster-git spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: # matrix 'parent' generator - matrix: @@ -132,10 +136,10 @@ spec: selector: matchLabels: argocd.argoproj.io/secret-type: cluster - kubernetes.io/environment: '{{path.basename}}' + kubernetes.io/environment: '{{.path.basename}}' template: metadata: - name: '{{name}}-guestbook' + name: '{{.name}}-guestbook' spec: project: default source: @@ -143,7 +147,7 @@ spec: targetRevision: HEAD path: "examples/git-generator-files-discovery/apps/guestbook" destination: - server: '{{server}}' + server: '{{.server}}' namespace: guestbook ``` Here is the corresponding folder structure for the git repository used by the git-files generator: @@ -162,8 +166,8 @@ Here is the corresponding folder structure for the git repository used by the gi │ └── config.json └── git-generator-files.yaml ``` -In the above example, the `{{path.basename}}` parameters produced by the git-files generator will resolve to `dev` and `prod`. -In the 2nd child generator, the label selector with label `kubernetes.io/environment: {{path.basename}}` will resolve with the values produced by the first child generator's parameters (`kubernetes.io/environment: prod` and `kubernetes.io/environment: dev`). +In the above example, the `{{.path.basename}}` parameters produced by the git-files generator will resolve to `dev` and `prod`. +In the 2nd child generator, the label selector with label `kubernetes.io/environment: {{.path.basename}}` will resolve with the values produced by the first child generator's parameters (`kubernetes.io/environment: prod` and `kubernetes.io/environment: dev`). So in the above example, clusters with the label `kubernetes.io/environment: prod` will have only prod-specific configuration (ie. `prod/config.json`) applied to it, wheres clusters with the label `kubernetes.io/environment: dev` will have only dev-specific configuration (ie. `dev/config.json`) @@ -262,6 +266,8 @@ kind: ApplicationSet metadata: name: two-gits-with-path-param-prefix spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - matrix: generators: @@ -280,7 +286,7 @@ spec: repoURL: https://github.com/some-org/some-repo.git revision: HEAD files: - - path: "targets/{{appName}}/*.json" + - path: "targets/{{.appName}}/*.json" pathParamPrefix: target template: {} # ... ``` @@ -390,7 +396,7 @@ For example, the below example would be invalid (cluster-generator must come aft selector: matchLabels: argocd.argoproj.io/secret-type: cluster - kubernetes.io/environment: '{{path.basename}}' # {{path.basename}} is produced by git-files generator + kubernetes.io/environment: '{{.path.basename}}' # {{.path.basename}} is produced by git-files generator # git generator, 'child' #2 - git: repoURL: https://github.com/argoproj/applicationset.git @@ -398,7 +404,7 @@ For example, the below example would be invalid (cluster-generator must come aft files: - path: "examples/git-generator-files-discovery/cluster-config/**/config.json" -1. You cannot have both child generators consuming parameters from each another. In the example below, the cluster generator is consuming the `{{path.basename}}` parameter produced by the git-files generator, whereas the git-files generator is consuming the `{{name}}` parameter produced by the cluster generator. This will result in a circular dependency, which is invalid. +1. You cannot have both child generators consuming parameters from each another. In the example below, the cluster generator is consuming the `{{.path.basename}}` parameter produced by the git-files generator, whereas the git-files generator is consuming the `{{.name}}` parameter produced by the cluster generator. This will result in a circular dependency, which is invalid. - matrix: generators: @@ -407,13 +413,13 @@ For example, the below example would be invalid (cluster-generator must come aft selector: matchLabels: argocd.argoproj.io/secret-type: cluster - kubernetes.io/environment: '{{path.basename}}' # {{path.basename}} is produced by git-files generator + kubernetes.io/environment: '{{.path.basename}}' # {{.path.basename}} is produced by git-files generator # git generator, 'child' #2 - git: repoURL: https://github.com/argoproj/applicationset.git revision: HEAD files: - - path: "examples/git-generator-files-discovery/cluster-config/engineering/{{name}}**/config.json" # {{name}} is produced by cluster generator + - path: "examples/git-generator-files-discovery/cluster-config/engineering/{{.name}}**/config.json" # {{.name}} is produced by cluster generator 1. When using a Matrix generator nested inside another Matrix or Merge generator, [Post Selectors](Generators-Post-Selector.md) for this nested generator's generators will only be applied when enabled via `spec.applyNestedSelectors`. You may also need to enable this even if your Post Selectors are not within the nested matrix or Merge generator, but are instead a sibling of a nested Matrix or Merge generator. diff --git a/docs/operator-manual/applicationset/Generators-Merge.md b/docs/operator-manual/applicationset/Generators-Merge.md index 50da174cf349a..b2ccfe86fb66d 100644 --- a/docs/operator-manual/applicationset/Generators-Merge.md +++ b/docs/operator-manual/applicationset/Generators-Merge.md @@ -17,6 +17,8 @@ kind: ApplicationSet metadata: name: cluster-git spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: # merge 'parent' generator - merge: @@ -41,9 +43,9 @@ spec: values.redis: 'true' template: metadata: - name: '{{name}}' + name: '{{.name}}' spec: - project: '{{metadata.labels.environment}}' + project: '{{index .metadata.labels "environment"}}' source: repoURL: https://github.com/argoproj/argo-cd.git targetRevision: HEAD @@ -51,11 +53,11 @@ spec: helm: parameters: - name: kafka - value: '{{values.kafka}}' + value: '{{.values.kafka}}' - name: redis - value: '{{values.redis}}' + value: '{{.values.redis}}' destination: - server: '{{server}}' + server: '{{.server}}' namespace: default ``` @@ -122,6 +124,8 @@ kind: ApplicationSet metadata: name: cluster-git spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: # merge 'parent' generator: # Use the selector set by both child generators to combine them. @@ -135,7 +139,7 @@ spec: # Set the selector to this location. - clusters: values: - selector: '{{ metadata.labels.location }}' + selector: '{{index .metadata.labels "location"}}' # The git repo may have different directories which correspond to the # cluster locations, using these as a selector. - git: @@ -144,19 +148,19 @@ spec: directories: - path: '*' values: - selector: '{{ path }}' + selector: '{{.path.path}}' template: metadata: - name: '{{name}}' + name: '{{.name}}' spec: - project: '{{metadata.labels.environment}}' + project: '{{index .metadata.labels "environment"}}' source: repoURL: https://github.com/argoproj/argocd-example-apps/ # The cluster values field for each generator will be substituted here: targetRevision: HEAD - path: '{{path}}' + path: '{{.path.path}}' destination: - server: '{{server}}' + server: '{{.server}}' namespace: default ``` diff --git a/docs/operator-manual/applicationset/Generators-Plugin.md b/docs/operator-manual/applicationset/Generators-Plugin.md index 3747c38865df5..d0888b9949b8e 100644 --- a/docs/operator-manual/applicationset/Generators-Plugin.md +++ b/docs/operator-manual/applicationset/Generators-Plugin.md @@ -22,6 +22,8 @@ kind: ApplicationSet metadata: name: myplugin spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - plugin: # Specify the configMap where the plugin configuration is located. @@ -51,10 +53,10 @@ spec: metadata: name: myplugin annotations: - example.from.input.parameters: "{{ generator.input.parameters.map.key1 }}" - example.from.values: "{{ values.value1 }}" + example.from.input.parameters: "{{ index .generator.input.parameters.map "key1" }}" + example.from.values: "{{ .values.value1 }}" # The plugin determines what else it produces. - example.from.plugin.output: "{{ something.from.the.plugin }}" + example.from.plugin.output: "{{ .something.from.the.plugin }}" ``` - `configMapRef.name`: A `ConfigMap` name containing the plugin configuration to use for RPC call. @@ -230,6 +232,7 @@ metadata: name: fb-matrix spec: goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - matrix: generators: diff --git a/docs/operator-manual/applicationset/Generators-Post-Selector.md b/docs/operator-manual/applicationset/Generators-Post-Selector.md index d8570859084ff..aac134e0b6212 100644 --- a/docs/operator-manual/applicationset/Generators-Post-Selector.md +++ b/docs/operator-manual/applicationset/Generators-Post-Selector.md @@ -9,6 +9,8 @@ kind: ApplicationSet metadata: name: guestbook spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - list: elements: @@ -23,15 +25,15 @@ spec: env: staging template: metadata: - name: '{{cluster}}-guestbook' + name: '{{.cluster}}-guestbook' spec: project: default source: repoURL: https://github.com/argoproj-labs/applicationset.git targetRevision: HEAD - path: examples/list-generator/guestbook/{{cluster}} + path: examples/list-generator/guestbook/{{.cluster}} destination: - server: '{{url}}' + server: '{{.url}}' namespace: guestbook ``` diff --git a/docs/operator-manual/applicationset/Generators-Pull-Request.md b/docs/operator-manual/applicationset/Generators-Pull-Request.md index 298e5135392ce..e54fc385d7d28 100644 --- a/docs/operator-manual/applicationset/Generators-Pull-Request.md +++ b/docs/operator-manual/applicationset/Generators-Pull-Request.md @@ -8,6 +8,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: # When using a Pull Request generator, the ApplicationSet controller polls every `requeueAfterSeconds` interval (defaulting to every 30 minutes) to detect changes. @@ -33,6 +35,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: github: @@ -75,6 +79,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: gitlab: @@ -117,6 +123,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: gitea: @@ -153,6 +161,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: bitbucketServer: @@ -195,6 +205,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: bitbucket: @@ -251,6 +263,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: azuredevops: @@ -292,6 +306,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: # ... @@ -319,21 +335,23 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: # ... template: metadata: - name: 'myapp-{{branch}}-{{number}}' + name: 'myapp-{{.branch}}-{{.number}}' spec: source: repoURL: 'https://github.com/myorg/myrepo.git' - targetRevision: '{{head_sha}}' + targetRevision: '{{.head_sha}}' path: kubernetes/ helm: parameters: - name: "image.tag" - value: "pull-{{head_sha}}" + value: "pull-{{.head_sha}}" project: "my-project" destination: server: https://kubernetes.default.svc @@ -348,23 +366,25 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - pullRequest: # ... template: metadata: - name: 'myapp-{{branch}}-{{number}}' + name: 'myapp-{{.branch}}-{{.number}}' spec: source: repoURL: 'https://github.com/myorg/myrepo.git' - targetRevision: '{{head_sha}}' + targetRevision: '{{.head_sha}}' path: kubernetes/ kustomize: - nameSuffix: {{branch}} + nameSuffix: '{{.branch}}' commonLabels: - app.kubernetes.io/instance: {{branch}}-{{number}} + app.kubernetes.io/instance: '{{.branch}}-{{.number}}' images: - - ghcr.io/myorg/myrepo:{{head_sha}} + - 'ghcr.io/myorg/myrepo:{{.head_sha}}' project: "my-project" destination: server: https://kubernetes.default.svc diff --git a/docs/operator-manual/applicationset/Generators-SCM-Provider.md b/docs/operator-manual/applicationset/Generators-SCM-Provider.md index 5e3c4a6ab8aa4..6b11d344eac80 100644 --- a/docs/operator-manual/applicationset/Generators-SCM-Provider.md +++ b/docs/operator-manual/applicationset/Generators-SCM-Provider.md @@ -395,16 +395,18 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - scmProvider: # ... template: metadata: - name: '{{ repository }}' + name: '{{ .repository }}' spec: source: - repoURL: '{{ url }}' - targetRevision: '{{ branch }}' + repoURL: '{{ .url }}' + targetRevision: '{{ .branch }}' path: kubernetes/ project: default destination: @@ -433,6 +435,8 @@ kind: ApplicationSet metadata: name: myapps spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - scmProvider: bitbucketServer: @@ -445,15 +449,15 @@ spec: secretName: mypassword key: password values: - name: "{{organization}}-{{repository}}" + name: "{{.organization}}-{{.repository}}" template: metadata: - name: '{{ values.name }}' + name: '{{ .values.name }}' spec: source: - repoURL: '{{ url }}' - targetRevision: '{{ branch }}' + repoURL: '{{ .url }}' + targetRevision: '{{ .branch }}' path: kubernetes/ project: default destination: diff --git a/docs/operator-manual/applicationset/Progressive-Syncs.md b/docs/operator-manual/applicationset/Progressive-Syncs.md index 8864151e9dcb7..edfe0dad101f2 100644 --- a/docs/operator-manual/applicationset/Progressive-Syncs.md +++ b/docs/operator-manual/applicationset/Progressive-Syncs.md @@ -52,8 +52,7 @@ Once a change is pushed, the following will happen in order. * The rollout will wait for all `env-qa` Applications to be manually synced via the `argocd` CLI or by clicking the Sync button in the UI. * 10% of all `env-prod` Applications will be updated at a time until all `env-prod` Applications have been updated. -``` ---- +```yaml apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: diff --git a/docs/operator-manual/applicationset/Use-Cases.md b/docs/operator-manual/applicationset/Use-Cases.md index 0e9c65d3963ee..a13c6598072ca 100644 --- a/docs/operator-manual/applicationset/Use-Cases.md +++ b/docs/operator-manual/applicationset/Use-Cases.md @@ -68,10 +68,26 @@ Thus in the self-service use case, administrators desire to only allow some fiel Fortunately, the ApplicationSet controller presents an alternative solution to this use case: cluster administrators may safely create an `ApplicationSet` resource containing a Git generator that restricts deployment of application resources to fixed values with the `template` field, while allowing customization of 'safe' fields by developers, at will. +The `config.json` files contain information describing the app. + +```json +{ + (...) + "app": { + "source": "https://github.com/argoproj/argo-cd", + "revision": "HEAD", + "path": "applicationset/examples/git-generator-files-discovery/apps/guestbook" + } + (...) +} +``` + ```yaml kind: ApplicationSet # (...) spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - git: repoURL: https://github.com/argoproj/argo-cd.git @@ -82,9 +98,9 @@ spec: project: dev-team-one # project is restricted source: # developers may customize app details using JSON files from above repo URL - repoURL: {{app.source}} - targetRevision: {{app.revision}} - path: {{app.path}} + repoURL: {{.app.source}} + targetRevision: {{.app.revision}} + path: {{.app.path}} destination: name: production-cluster # cluster is restricted namespace: dev-team-one # namespace is restricted diff --git a/docs/operator-manual/applicationset/index.md b/docs/operator-manual/applicationset/index.md index 1fe83fb2a0952..ea7c0f3deaf5d 100644 --- a/docs/operator-manual/applicationset/index.md +++ b/docs/operator-manual/applicationset/index.md @@ -27,6 +27,8 @@ kind: ApplicationSet metadata: name: guestbook spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] generators: - list: elements: @@ -38,15 +40,15 @@ spec: url: https://9.8.7.6 template: metadata: - name: '{{cluster}}-guestbook' + name: '{{.cluster}}-guestbook' spec: project: my-project source: repoURL: https://github.com/infra-team/cluster-deployments.git targetRevision: HEAD - path: guestbook/{{cluster}} + path: guestbook/{{.cluster}} destination: - server: '{{url}}' + server: '{{.url}}' namespace: guestbook ``` diff --git a/docs/operator-manual/user-management/identity-center.md b/docs/operator-manual/user-management/identity-center.md new file mode 100644 index 0000000000000..0fd78b1aaf62f --- /dev/null +++ b/docs/operator-manual/user-management/identity-center.md @@ -0,0 +1,79 @@ +# Identity Center (AWS SSO) + +!!! note "Are you using this? Please contribute!" + If you're using this IdP please consider [contributing](../../developer-guide/site.md) to this document. + +A working Single Sign-On configuration using Identity Center (AWS SSO) has been achieved using the following method: + +* [SAML (with Dex)](#saml-with-dex) + +## SAML (with Dex) + +1. Create a new SAML application in Identity Center and download the certificate. + * ![Identity Center SAML App 1](../../assets/identity-center-1.png) + * ![Identity Center SAML App 2](../../assets/identity-center-2.png) +2. Click `Assign Users` after creating the application in Identity Center, and select the users or user groups you wish to grant access to this application. + * ![Identity Center SAML App 3](../../assets/identity-center-3.png) +3. Copy the Argo CD URL into the `data.url` field in the `argocd-cm` ConfigMap. + + data: + url: https://argocd.example.com + +4. Configure Attribute mappings. + + !!! note "Group attribute mapping is not officially!" + Group attribute mapping is not officially supported in the AWS docs, however the workaround is currently working. + + * ![Identity Center SAML App 4](../../assets/identity-center-4.png) + * ![Identity Center SAML App 5](../../assets/identity-center-5.png) + + + +5. Download the CA certificate to use in the `argocd-cm` configuration. + * If using the `caData` field, you'll need to base64-encode the entire certificate, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` stanzas (e.g., `base64 my_cert.pem`). + * If using the `ca` field and storing the CA certificate separately as a secret, you will need to mount the secret onto the `dex` container in the `argocd-dex-server` Deployment. + * ![Identity Center SAML App 6](../../assets/identity-center-6.png) +6. Edit the `argocd-cm` and configure the `data.dex.config` section: + + +```yaml +dex.config: | + logger: + level: debug + format: json + connectors: + - type: saml + id: aws + name: "AWS IAM Identity Center" + config: + # You need value of Identity Center APP SAML (IAM Identity Center sign-in URL) + ssoURL: https://portal.sso.yourregion.amazonaws.com/saml/assertion/id + # You need `caData` _OR_ `ca`, but not both. + caData: + # Path to mount the secret to the dex container + entityIssuer: https://external.path.to.argocd.io/api/dex/callback + redirectURI: https://external.path.to.argocd.io/api/dex/callback + usernameAttr: email + emailAttr: email + groupsAttr: groups +``` + + +### Connect Identity Center Groups to Argo CD Roles +Argo CD recognizes user memberships in Identity Center groups that match the **Group Attribute Statements** regex. + + In the example above, the regex `argocd-*` is used, making Argo CD aware of a group named `argocd-admins`. + +Modify the `argocd-rbac-cm` ConfigMap to connect the `ArgoCD-administrators` Identity Center group to the builtin Argo CD `admin` role. + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-rbac-cm +data: + policy.csv: | + g, , role:admin + scopes: '[groups, email]' +``` + diff --git a/docs/snyk/index.md b/docs/snyk/index.md index a8e97a7018013..984cd3460c17d 100644 --- a/docs/snyk/index.md +++ b/docs/snyk/index.md @@ -15,38 +15,38 @@ recent minor releases. |---:|:--------:|:----:|:------:|:---:| | [go.mod](master/argocd-test.html) | 0 | 0 | 6 | 0 | | [ui/yarn.lock](master/argocd-test.html) | 0 | 0 | 0 | 0 | -| [dex:v2.37.0](master/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 0 | -| [haproxy:2.6.14-alpine](master/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 4 | 19 | -| [redis:7.0.11-alpine](master/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 0 | +| [dex:v2.37.0](master/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 1 | +| [haproxy:2.6.14-alpine](master/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 4 | 16 | +| [redis:7.0.11-alpine](master/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 1 | | [install.yaml](master/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](master/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.9.0-rc2 +### v2.9.0-rc3 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.9.0-rc2/argocd-test.html) | 0 | 2 | 6 | 0 | -| [ui/yarn.lock](v2.9.0-rc2/argocd-test.html) | 0 | 0 | 0 | 0 | -| [dex:v2.37.0](v2.9.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.9.0-rc2/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.9.0-rc2](v2.9.0-rc2/quay.io_argoproj_argocd_v2.9.0-rc2.html) | 0 | 2 | 7 | 20 | -| [redis:7.0.11-alpine](v2.9.0-rc2/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 0 | -| [install.yaml](v2.9.0-rc2/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.9.0-rc2/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.9.0-rc3/argocd-test.html) | 0 | 2 | 6 | 0 | +| [ui/yarn.lock](v2.9.0-rc3/argocd-test.html) | 0 | 0 | 0 | 0 | +| [dex:v2.37.0](v2.9.0-rc3/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 1 | +| [haproxy:2.6.14-alpine](v2.9.0-rc3/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:v2.9.0-rc3](v2.9.0-rc3/quay.io_argoproj_argocd_v2.9.0-rc3.html) | 0 | 0 | 4 | 16 | +| [redis:7.0.11-alpine](v2.9.0-rc3/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 1 | +| [install.yaml](v2.9.0-rc3/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.9.0-rc3/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.8.4 +### v2.8.5 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.8.4/argocd-test.html) | 0 | 2 | 6 | 0 | -| [ui/yarn.lock](v2.8.4/argocd-test.html) | 0 | 0 | 0 | 0 | -| [dex:v2.37.0](v2.8.4/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.8.4/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.8.4](v2.8.4/quay.io_argoproj_argocd_v2.8.4.html) | 0 | 2 | 7 | 20 | -| [redis:7.0.11-alpine](v2.8.4/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 0 | -| [install.yaml](v2.8.4/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.8.4/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.8.5/argocd-test.html) | 0 | 0 | 6 | 0 | +| [ui/yarn.lock](v2.8.5/argocd-test.html) | 0 | 0 | 0 | 0 | +| [dex:v2.37.0](v2.8.5/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 1 | +| [haproxy:2.6.14-alpine](v2.8.5/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:v2.8.5](v2.8.5/quay.io_argoproj_argocd_v2.8.5.html) | 0 | 0 | 4 | 16 | +| [redis:7.0.11-alpine](v2.8.5/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 1 | +| [install.yaml](v2.8.5/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.8.5/argocd-iac-namespace-install.html) | - | - | - | - | ### v2.7.14 @@ -54,10 +54,10 @@ recent minor releases. |---:|:--------:|:----:|:------:|:---:| | [go.mod](v2.7.14/argocd-test.html) | 0 | 3 | 5 | 0 | | [ui/yarn.lock](v2.7.14/argocd-test.html) | 0 | 1 | 0 | 0 | -| [dex:v2.37.0](v2.7.14/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.7.14/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.7.14](v2.7.14/quay.io_argoproj_argocd_v2.7.14.html) | 0 | 2 | 7 | 20 | -| [redis:7.0.11-alpine](v2.7.14/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 0 | +| [dex:v2.37.0](v2.7.14/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 1 | +| [haproxy:2.6.14-alpine](v2.7.14/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:v2.7.14](v2.7.14/quay.io_argoproj_argocd_v2.7.14.html) | 0 | 2 | 8 | 20 | +| [redis:7.0.11-alpine](v2.7.14/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 1 | | [install.yaml](v2.7.14/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.7.14/argocd-iac-namespace-install.html) | - | - | - | - | @@ -67,9 +67,9 @@ recent minor releases. |---:|:--------:|:----:|:------:|:---:| | [go.mod](v2.6.15/argocd-test.html) | 0 | 3 | 5 | 0 | | [ui/yarn.lock](v2.6.15/argocd-test.html) | 0 | 1 | 0 | 0 | -| [dex:v2.37.0](v2.6.15/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.6.15/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.6.15](v2.6.15/quay.io_argoproj_argocd_v2.6.15.html) | 0 | 2 | 7 | 20 | -| [redis:7.0.11-alpine](v2.6.15/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 0 | +| [dex:v2.37.0](v2.6.15/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 0 | 3 | 1 | +| [haproxy:2.6.14-alpine](v2.6.15/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 1 | +| [argocd:v2.6.15](v2.6.15/quay.io_argoproj_argocd_v2.6.15.html) | 0 | 2 | 8 | 20 | +| [redis:7.0.11-alpine](v2.6.15/redis_7.0.11-alpine.html) | 1 | 0 | 3 | 1 | | [install.yaml](v2.6.15/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.6.15/argocd-iac-namespace-install.html) | - | - | - | - | diff --git a/docs/snyk/master/argocd-iac-install.html b/docs/snyk/master/argocd-iac-install.html index 418bfdecc40fa..28be7b9bb102b 100644 --- a/docs/snyk/master/argocd-iac-install.html +++ b/docs/snyk/master/argocd-iac-install.html @@ -456,7 +456,7 @@

Snyk test report

-

October 22nd 2023, 12:17:18 am (UTC+00:00)

+

October 29th 2023, 12:17:42 am (UTC+00:00)

Scanned the following path: @@ -789,7 +789,7 @@

Container could be running with outdated image

  • - Line number: 21630 + Line number: 21642
    • @@ -1137,7 +1137,7 @@

    Container has no CPU limit

  • - Line number: 21630 + Line number: 21642
    • @@ -1253,7 +1253,7 @@

    Container has no CPU limit

  • - Line number: 21715 + Line number: 21727
    • @@ -1311,7 +1311,7 @@

    Container has no CPU limit

  • - Line number: 22031 + Line number: 22043
    • @@ -1623,7 +1623,7 @@

    Container is running without liveness probe

  • - Line number: 21630 + Line number: 21642
    • @@ -1971,7 +1971,7 @@

    Container is running without memory limit

  • - Line number: 21630 + Line number: 21642
    • @@ -2087,7 +2087,7 @@

    Container is running without memory limit

  • - Line number: 21715 + Line number: 21727
    • @@ -2145,7 +2145,7 @@

    Container is running without memory limit

  • - Line number: 22031 + Line number: 22043
    • @@ -2481,7 +2481,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 21637 + Line number: 21649
    • @@ -2537,7 +2537,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 21603 + Line number: 21615
    • @@ -2593,7 +2593,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 21941 + Line number: 21953
    • @@ -2649,7 +2649,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 22179 + Line number: 22191
    • diff --git a/docs/snyk/master/argocd-iac-namespace-install.html b/docs/snyk/master/argocd-iac-namespace-install.html index d5402379c9056..e043d126f446c 100644 --- a/docs/snyk/master/argocd-iac-namespace-install.html +++ b/docs/snyk/master/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:17:28 am (UTC+00:00)

    +

    October 29th 2023, 12:17:54 am (UTC+00:00)

    Scanned the following path: @@ -789,7 +789,7 @@

    Container could be running with outdated image

  • - Line number: 1286 + Line number: 1298
    • @@ -1137,7 +1137,7 @@

    Container has no CPU limit

  • - Line number: 1286 + Line number: 1298
    • @@ -1253,7 +1253,7 @@

    Container has no CPU limit

  • - Line number: 1371 + Line number: 1383
    • @@ -1311,7 +1311,7 @@

    Container has no CPU limit

  • - Line number: 1687 + Line number: 1699
    • @@ -1623,7 +1623,7 @@

    Container is running without liveness probe

  • - Line number: 1286 + Line number: 1298
    • @@ -1971,7 +1971,7 @@

    Container is running without memory limit

  • - Line number: 1286 + Line number: 1298
    • @@ -2087,7 +2087,7 @@

    Container is running without memory limit

  • - Line number: 1371 + Line number: 1383
    • @@ -2145,7 +2145,7 @@

    Container is running without memory limit

  • - Line number: 1687 + Line number: 1699
    • @@ -2481,7 +2481,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1293 + Line number: 1305
    • @@ -2537,7 +2537,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1259 + Line number: 1271
    • @@ -2593,7 +2593,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1597 + Line number: 1609
    • @@ -2649,7 +2649,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1835 + Line number: 1847
    • diff --git a/docs/snyk/master/argocd-test.html b/docs/snyk/master/argocd-test.html index baf98e4e8af70..1b2486932df9e 100644 --- a/docs/snyk/master/argocd-test.html +++ b/docs/snyk/master/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:14:48 am (UTC+00:00)

    +

    October 29th 2023, 12:14:38 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html index d5818b81cb2f5..167a203368fb3 100644 --- a/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html +++ b/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:15:00 am (UTC+00:00)

    +

    October 29th 2023, 12:14:53 am (UTC+00:00)

    Scanned the following paths: @@ -466,8 +466,8 @@

    Snyk test report

    -
    27 known vulnerabilities
    -
    72 vulnerable dependency paths
    +
    28 known vulnerabilities
    +
    79 vulnerable dependency paths
    786 dependencies
    @@ -648,12 +648,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.37.0 and openssl/libcrypto3@3.1.1-r1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/snyk/master/haproxy_2.6.14-alpine.html b/docs/snyk/master/haproxy_2.6.14-alpine.html index b0b4060ee0d33..19c8202ec7564 100644 --- a/docs/snyk/master/haproxy_2.6.14-alpine.html +++ b/docs/snyk/master/haproxy_2.6.14-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:15:08 am (UTC+00:00)

    +

    October 29th 2023, 12:15:02 am (UTC+00:00)

    Scanned the following path: @@ -466,8 +466,8 @@

    Snyk test report

    -
    0 known vulnerabilities
    -
    0 vulnerable dependency paths
    +
    1 known vulnerabilities
    +
    9 vulnerable dependency paths
    18 dependencies
    @@ -484,7 +484,198 @@

    Snyk test report

    - No known vulnerabilities detected. +
    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.2-r0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    diff --git a/docs/snyk/master/quay.io_argoproj_argocd_latest.html b/docs/snyk/master/quay.io_argoproj_argocd_latest.html index 4241230700e76..c9b59ef5e997f 100644 --- a/docs/snyk/master/quay.io_argoproj_argocd_latest.html +++ b/docs/snyk/master/quay.io_argoproj_argocd_latest.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

    Snyk test report

    -

    October 22nd 2023, 12:15:33 am (UTC+00:00)

    +

    October 29th 2023, 12:15:33 am (UTC+00:00)

    Scanned the following paths:
      -
    • quay.io/argoproj/argocd:latest/argoproj/argocd (deb)
    • quay.io/argoproj/argocd:latest/argoproj/argo-cd/v2 (gomodules)
    • quay.io/argoproj/argocd:latest/kustomize/kustomize/v5 (gomodules)
    • quay.io/argoproj/argocd:latest/helm/v3 (gomodules)
    • quay.io/argoproj/argocd:latest/git-lfs/git-lfs (gomodules)
      • +
    • quay.io/argoproj/argocd:latest/argoproj/argocd (deb)
    • quay.io/argoproj/argocd:latest/argoproj/argo-cd/v2 (gomodules)
    • quay.io/argoproj/argocd:latest (gomodules)
    • quay.io/argoproj/argocd:latest/helm/v3 (gomodules)
    • quay.io/argoproj/argocd:latest/git-lfs/git-lfs (gomodules)
    -
    31 known vulnerabilities
    -
    123 vulnerable dependency paths
    -
    2320 dependencies
    +
    28 known vulnerabilities
    +
    96 vulnerable dependency paths
    +
    2235 dependencies
    @@ -531,12 +531,15 @@

    Remediation

    Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

    References

    @@ -1929,600 +1933,6 @@

    References

    More about this vulnerability

    - -
    -

    Improper Authentication

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - openssl/libssl3 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@latest and openssl/libssl3@3.0.2-0ubuntu1.10 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu:22.04. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    Issue summary: The AES-SIV cipher implementation contains a bug that causes - it to ignore empty associated data entries which are unauthenticated as - a consequence.

    -

    Impact summary: Applications that use the AES-SIV algorithm and want to - authenticate empty data entries as associated data can be mislead by removing - adding or reordering such empty entries as these are ignored by the OpenSSL - implementation. We are currently unaware of any such applications.

    -

    The AES-SIV algorithm allows for authentication of multiple associated - data entries along with the encryption. To authenticate empty data the - application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with - NULL pointer as the output buffer and 0 as the input buffer length. - The AES-SIV implementation in OpenSSL just returns success for such a call - instead of performing the associated data authentication operation. - The empty data thus will not be authenticated.

    -

    As this issue does not affect non-empty associated data authentication and - we expect it to be rare for an application to use empty associated data - entries this is qualified as Low severity issue.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 openssl.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Inefficient Regular Expression Complexity

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - openssl/libssl3 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@latest and openssl/libssl3@3.0.2-0ubuntu1.10 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    Issue summary: Checking excessively long DH keys or parameters may be very slow.

    -

    Impact summary: Applications that use the functions DH_check(), DH_check_ex() - or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long - delays. Where the key or parameters that are being checked have been obtained - from an untrusted source this may lead to a Denial of Service.

    -

    The function DH_check() performs various checks on DH parameters. One of those - checks confirms that the modulus ('p' parameter) is not too large. Trying to use - a very large modulus is slow and OpenSSL will not normally use a modulus which - is over 10,000 bits in length.

    -

    However the DH_check() function checks numerous aspects of the key or parameters - that have been supplied. Some of those checks use the supplied modulus value - even if it has already been found to be too large.

    -

    An application that calls DH_check() and supplies a key or parameters obtained - from an untrusted source could be vulernable to a Denial of Service attack.

    -

    The function DH_check() is itself called by a number of other OpenSSL functions. - An application calling any of those other functions may similarly be affected. - The other functions affected by this are DH_check_ex() and - EVP_PKEY_param_check().

    -

    Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications - when using the '-check' option.

    -

    The OpenSSL SSL/TLS implementation is not affected by this issue. - The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 openssl.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Excessive Iteration

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - openssl/libssl3 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@latest and openssl/libssl3@3.0.2-0ubuntu1.10 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    Issue summary: Checking excessively long DH keys or parameters may be very slow.

    -

    Impact summary: Applications that use the functions DH_check(), DH_check_ex() - or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long - delays. Where the key or parameters that are being checked have been obtained - from an untrusted source this may lead to a Denial of Service.

    -

    The function DH_check() performs various checks on DH parameters. After fixing - CVE-2023-3446 it was discovered that a large q parameter value can also trigger - an overly long computation during some of these checks. A correct q value, - if present, cannot be larger than the modulus p parameter, thus it is - unnecessary to perform these checks if q is larger than p.

    -

    An application that calls DH_check() and supplies a key or parameters obtained - from an untrusted source could be vulnerable to a Denial of Service attack.

    -

    The function DH_check() is itself called by a number of other OpenSSL functions. - An application calling any of those other functions may similarly be affected. - The other functions affected by this are DH_check_ex() and - EVP_PKEY_param_check().

    -

    Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications - when using the "-check" option.

    -

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    -

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 openssl.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    -

    CVE-2023-28531

    diff --git a/docs/snyk/master/redis_7.0.11-alpine.html b/docs/snyk/master/redis_7.0.11-alpine.html index a63c98a15030a..5409d26e74695 100644 --- a/docs/snyk/master/redis_7.0.11-alpine.html +++ b/docs/snyk/master/redis_7.0.11-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:15:40 am (UTC+00:00)

    +

    October 29th 2023, 12:15:46 am (UTC+00:00)

    Scanned the following path: @@ -466,8 +466,8 @@

    Snyk test report

    -
    4 known vulnerabilities
    -
    32 vulnerable dependency paths
    +
    5 known vulnerabilities
    +
    41 vulnerable dependency paths
    18 dependencies
    @@ -1127,6 +1127,7 @@

    References

  • openssl-security@openssl.org
  • openssl-security@openssl.org
  • openssl-security@openssl.org
    • +
  • openssl-security@openssl.org
    • @@ -1136,6 +1137,196 @@

    References

    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/snyk/v2.6.15/argocd-iac-install.html b/docs/snyk/v2.6.15/argocd-iac-install.html index 90c875983c384..6867e68c4bd18 100644 --- a/docs/snyk/v2.6.15/argocd-iac-install.html +++ b/docs/snyk/v2.6.15/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:27:56 am (UTC+00:00)

    +

    October 29th 2023, 12:30:07 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.6.15/argocd-iac-namespace-install.html b/docs/snyk/v2.6.15/argocd-iac-namespace-install.html index 1bd89d9664d2d..a0dbfd5315336 100644 --- a/docs/snyk/v2.6.15/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.6.15/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:28:06 am (UTC+00:00)

    +

    October 29th 2023, 12:30:19 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.6.15/argocd-test.html b/docs/snyk/v2.6.15/argocd-test.html index 2672f4aef0e82..cbf674fc20222 100644 --- a/docs/snyk/v2.6.15/argocd-test.html +++ b/docs/snyk/v2.6.15/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:25:59 am (UTC+00:00)

    +

    October 29th 2023, 12:27:33 am (UTC+00:00)

    Scanned the following paths: @@ -933,12 +933,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

    @@ -648,12 +648,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.37.0 and openssl/libcrypto3@3.1.1-r1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/snyk/v2.6.15/haproxy_2.6.14-alpine.html b/docs/snyk/v2.6.15/haproxy_2.6.14-alpine.html index e107d327e33f3..605a7d8b7d5bd 100644 --- a/docs/snyk/v2.6.15/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.6.15/haproxy_2.6.14-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:26:13 am (UTC+00:00)

    +

    October 29th 2023, 12:27:48 am (UTC+00:00)

    Scanned the following path: @@ -466,8 +466,8 @@

    Snyk test report

    -
    0 known vulnerabilities
    -
    0 vulnerable dependency paths
    +
    1 known vulnerabilities
    +
    9 vulnerable dependency paths
    18 dependencies
    @@ -484,7 +484,198 @@

    Snyk test report

    - No known vulnerabilities detected. +
    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.2-r0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    diff --git a/docs/snyk/v2.6.15/quay.io_argoproj_argocd_v2.6.15.html b/docs/snyk/v2.6.15/quay.io_argoproj_argocd_v2.6.15.html index 4afe990dd0ffb..759d3b81c634b 100644 --- a/docs/snyk/v2.6.15/quay.io_argoproj_argocd_v2.6.15.html +++ b/docs/snyk/v2.6.15/quay.io_argoproj_argocd_v2.6.15.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:26:35 am (UTC+00:00)

    +

    October 29th 2023, 12:28:36 am (UTC+00:00)

    Scanned the following paths: @@ -466,8 +466,8 @@

    Snyk test report

    -
    47 known vulnerabilities
    -
    159 vulnerable dependency paths
    +
    48 known vulnerabilities
    +
    168 vulnerable dependency paths
    2063 dependencies
    @@ -699,12 +699,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

      +
    • Github Commit
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
      • +
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
      • +
    • GitHub Commit
    • Snyk Blog
    • Vulnerability Discovery
    • Vulnerability Explanation
      • @@ -870,12 +873,15 @@

      Remediation

      Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

      References

        +
      • Github Commit
      • GitHub Commit
      • GitHub Commit
      • GitHub Commit
        • +
      • GitHub Commit
      • GitHub Commit
      • GitHub Commit
      • GitHub Commit
        • +
      • GitHub Commit
      • Snyk Blog
      • Vulnerability Discovery
      • Vulnerability Explanation
        • @@ -1230,7 +1236,7 @@

        References

        -

        Heap-based Buffer Overflow

        +

        Out-of-bounds Write

        @@ -1301,6 +1307,8 @@

        References

        @@ -1502,6 +1510,213 @@

        References

        More about this vulnerability

        +
        +
        +

        CVE-2023-5363

        +
        + +
        + medium severity +
        + +
        + +
          +
        • + Package Manager: ubuntu:22.04 +
          • +
        • + Vulnerable module: + + openssl/libssl3 +
          • + +
        • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.6.15 and openssl/libssl3@3.0.2-0ubuntu1.10 + +
          • +
        + +
        + + +

        Detailed paths

        + +
          +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + libfido2/libfido2-1@1.10.0-1 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + openssh/openssh-client@1:8.9p1-3ubuntu0.3 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + ca-certificates@20230311ubuntu0.22.04.1 + › + openssl@3.0.2-0ubuntu1.10 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + git@1:2.34.1-1ubuntu1.10 + › + curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + › + libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 + › + krb5/libkrb5-3@1.19.2-2ubuntu0.2 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + openssl@3.0.2-0ubuntu1.10 + + + +
          • +
        • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.15 + › + ca-certificates@20230311ubuntu0.22.04.1 + › + openssl@3.0.2-0ubuntu1.10 + + + +
          • +
        + +
        + +
        + +

        NVD Description

        +

        Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

        +

        Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

        +

        Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

        +

        When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

        +

        For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

        +

        Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

        +

        Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

        +

        The OpenSSL SSL/TLS implementation is not affected by this issue.

        +

        The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

        +

        OpenSSL 3.1 and 3.0 are vulnerable to this issue.

        +

        Remediation

        +

        Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.12 or higher.

        +

        References

        + + +
        + +
        +

        More about this vulnerability

        +
        +

        Out-of-bounds Read

        @@ -2078,6 +2293,7 @@

        References

      • cve@mitre.org
      • cve@mitre.org
      • cve@mitre.org
        • +
      • cve@mitre.org
      @@ -3446,7 +3662,7 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as @@ -3466,7 +3682,7 @@

      NVD Description

      we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.12 or higher.

      References

      • ADVISORY
        • @@ -3663,7 +3879,7 @@

        NVD Description

        The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

        Remediation

        -

        There is no fixed version for Ubuntu:22.04 openssl.

        +

        Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.12 or higher.

        References

        @@ -1136,6 +1137,196 @@

        References

        +
        +

        CVE-2023-5363

        +
        + +
        + low severity +
        + +
        + +
          +
        • + Package Manager: alpine:3.18 +
          • +
        • + Vulnerable module: + + openssl/libcrypto3 +
          • + +
        • Introduced through: + + docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1 + +
          • +
        + +
        + + +

        Detailed paths

        + +
          +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        + +
        + +
        + +

        NVD Description

        +

        Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

        +

        Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

        +

        Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

        +

        When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

        +

        For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

        +

        Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

        +

        Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

        +

        The OpenSSL SSL/TLS implementation is not affected by this issue.

        +

        The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

        +

        OpenSSL 3.1 and 3.0 are vulnerable to this issue.

        +

        Remediation

        +

        Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

        +

        References

        + + +
        + +
        +

        More about this vulnerability

        +
        + +
        diff --git a/docs/snyk/v2.7.14/argocd-iac-install.html b/docs/snyk/v2.7.14/argocd-iac-install.html index ab8ddd883ddd9..602c76a57c103 100644 --- a/docs/snyk/v2.7.14/argocd-iac-install.html +++ b/docs/snyk/v2.7.14/argocd-iac-install.html @@ -456,7 +456,7 @@

        Snyk test report

        -

        October 22nd 2023, 12:25:32 am (UTC+00:00)

        +

        October 29th 2023, 12:27:04 am (UTC+00:00)

        Scanned the following path: diff --git a/docs/snyk/v2.7.14/argocd-iac-namespace-install.html b/docs/snyk/v2.7.14/argocd-iac-namespace-install.html index d185574255ccc..937ce3343905e 100644 --- a/docs/snyk/v2.7.14/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.7.14/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

        Snyk test report

        -

        October 22nd 2023, 12:25:44 am (UTC+00:00)

        +

        October 29th 2023, 12:27:17 am (UTC+00:00)

        Scanned the following path: diff --git a/docs/snyk/v2.7.14/argocd-test.html b/docs/snyk/v2.7.14/argocd-test.html index f004e6e9bd197..342599913dab0 100644 --- a/docs/snyk/v2.7.14/argocd-test.html +++ b/docs/snyk/v2.7.14/argocd-test.html @@ -456,7 +456,7 @@

        Snyk test report

        -

        October 22nd 2023, 12:23:29 am (UTC+00:00)

        +

        October 29th 2023, 12:24:41 am (UTC+00:00)

        Scanned the following paths: @@ -933,12 +933,15 @@

        Remediation

        Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

        References

        @@ -648,12 +648,15 @@

        Remediation

        Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

        References

        +
        +

        CVE-2023-5363

        +
        + +
        + low severity +
        + +
        + +
          +
        • + Package Manager: alpine:3.18 +
          • +
        • + Vulnerable module: + + openssl/libcrypto3 +
          • + +
        • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.37.0 and openssl/libcrypto3@3.1.1-r1 + +
          • +
        + +
        + + +

        Detailed paths

        + +
          +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
          • +
        + +
        + +
        + +

        NVD Description

        +

        Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

        +

        Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

        +

        Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

        +

        When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

        +

        For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

        +

        Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

        +

        Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

        +

        The OpenSSL SSL/TLS implementation is not affected by this issue.

        +

        The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

        +

        OpenSSL 3.1 and 3.0 are vulnerable to this issue.

        +

        Remediation

        +

        Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

        +

        References

        + + +
        + +
        +

        More about this vulnerability

        +
        + +
        diff --git a/docs/snyk/v2.7.14/haproxy_2.6.14-alpine.html b/docs/snyk/v2.7.14/haproxy_2.6.14-alpine.html index 007cb149e346e..953bbbe0d1e05 100644 --- a/docs/snyk/v2.7.14/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.7.14/haproxy_2.6.14-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

        Snyk test report

        -

        October 22nd 2023, 12:23:41 am (UTC+00:00)

        +

        October 29th 2023, 12:24:59 am (UTC+00:00)

        Scanned the following path: @@ -466,8 +466,8 @@

        Snyk test report

        -
        0 known vulnerabilities
        -
        0 vulnerable dependency paths
        +
        1 known vulnerabilities
        +
        9 vulnerable dependency paths
        18 dependencies
        @@ -484,7 +484,198 @@

        Snyk test report

        - No known vulnerabilities detected. +
        +
        +

        CVE-2023-5363

        +
        + +
        + low severity +
        + +
        + +
          +
        • + Package Manager: alpine:3.18 +
          • +
        • + Vulnerable module: + + openssl/libcrypto3 +
          • + +
        • Introduced through: + + docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.2-r0 + +
          • +
        + +
        + + +

        Detailed paths

        + +
          +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libcrypto3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libcrypto3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + › + openssl/libcrypto3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libssl3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
          • +
        • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
          • +
        + +
        + +
        + +

        NVD Description

        +

        Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

        +

        Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

        +

        Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

        +

        When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

        +

        For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

        +

        Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

        +

        Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

        +

        The OpenSSL SSL/TLS implementation is not affected by this issue.

        +

        The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

        +

        OpenSSL 3.1 and 3.0 are vulnerable to this issue.

        +

        Remediation

        +

        Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

        +

        References

        + + +
        + +
        +

        More about this vulnerability

        +
        + +
        +
        diff --git a/docs/snyk/v2.7.14/quay.io_argoproj_argocd_v2.7.14.html b/docs/snyk/v2.7.14/quay.io_argoproj_argocd_v2.7.14.html index 03bd4c6c6ccf8..5b4ea7a6ff4d0 100644 --- a/docs/snyk/v2.7.14/quay.io_argoproj_argocd_v2.7.14.html +++ b/docs/snyk/v2.7.14/quay.io_argoproj_argocd_v2.7.14.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

        Snyk test report

        -

        October 22nd 2023, 12:24:02 am (UTC+00:00)

        +

        October 29th 2023, 12:25:22 am (UTC+00:00)

        Scanned the following paths: @@ -466,8 +466,8 @@

        Snyk test report

        -
        40 known vulnerabilities
        -
        150 vulnerable dependency paths
        +
        41 known vulnerabilities
        +
        159 vulnerable dependency paths
        2065 dependencies
        @@ -531,12 +531,15 @@

        Remediation

        Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

        References

          +
        • Github Commit
        • GitHub Commit
        • GitHub Commit
        • GitHub Commit
          • +
        • GitHub Commit
        • GitHub Commit
        • GitHub Commit
        • GitHub Commit
          • +
        • GitHub Commit
        • Snyk Blog
        • Vulnerability Discovery
        • Vulnerability Explanation
          • @@ -693,12 +696,15 @@

          Remediation

          Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

          References

            +
          • Github Commit
          • GitHub Commit
          • GitHub Commit
          • GitHub Commit
            • +
          • GitHub Commit
          • GitHub Commit
          • GitHub Commit
          • GitHub Commit
            • +
          • GitHub Commit
          • Snyk Blog
          • Vulnerability Discovery
          • Vulnerability Explanation
            • @@ -987,7 +993,7 @@

            References

            -

            Heap-based Buffer Overflow

            +

            Out-of-bounds Write

            @@ -1058,6 +1064,8 @@

            References

            @@ -1259,6 +1267,213 @@

            References

            More about this vulnerability

            +
            +
            +

            CVE-2023-5363

            +
            + +
            + medium severity +
            + +
            + +
              +
            • + Package Manager: ubuntu:22.04 +
              • +
            • + Vulnerable module: + + openssl/libssl3 +
              • + +
            • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.7.14 and openssl/libssl3@3.0.2-0ubuntu1.10 + +
              • +
            + +
            + + +

            Detailed paths

            + +
              +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + libfido2/libfido2-1@1.10.0-1 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + openssh/openssh-client@1:8.9p1-3ubuntu0.3 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + ca-certificates@20230311ubuntu0.22.04.1 + › + openssl@3.0.2-0ubuntu1.10 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + git@1:2.34.1-1ubuntu1.10 + › + curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + › + libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 + › + krb5/libkrb5-3@1.19.2-2ubuntu0.2 + › + openssl/libssl3@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + openssl@3.0.2-0ubuntu1.10 + + + +
              • +
            • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.14 + › + ca-certificates@20230311ubuntu0.22.04.1 + › + openssl@3.0.2-0ubuntu1.10 + + + +
              • +
            + +
            + +
            + +

            NVD Description

            +

            Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

            +

            Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

            +

            Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

            +

            When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

            +

            For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

            +

            Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

            +

            Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

            +

            The OpenSSL SSL/TLS implementation is not affected by this issue.

            +

            The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

            +

            OpenSSL 3.1 and 3.0 are vulnerable to this issue.

            +

            Remediation

            +

            Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.12 or higher.

            +

            References

            + + +
            + +
            +

            More about this vulnerability

            +
            +

            Out-of-bounds Read

            @@ -1835,6 +2050,7 @@

            References

          • cve@mitre.org
          • cve@mitre.org
          • cve@mitre.org
            • +
          • cve@mitre.org
          @@ -2915,7 +3131,7 @@

          Detailed paths

          NVD Description

          -

          Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu:22.04. +

          Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

          Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as @@ -2935,7 +3151,7 @@

          NVD Description

          we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.

          Remediation

          -

          There is no fixed version for Ubuntu:22.04 openssl.

          +

          Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.12 or higher.

          References

          • ADVISORY
            • @@ -3132,7 +3348,7 @@

            NVD Description

            The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

            Remediation

            -

            There is no fixed version for Ubuntu:22.04 openssl.

            +

            Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.12 or higher.

            References

            @@ -1136,6 +1137,196 @@

            References

            +
            +

            CVE-2023-5363

            +
            + +
            + low severity +
            + +
            + +
              +
            • + Package Manager: alpine:3.18 +
              • +
            • + Vulnerable module: + + openssl/libcrypto3 +
              • + +
            • Introduced through: + + docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1 + +
              • +
            + +
            + + +

            Detailed paths

            + +
              +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libcrypto3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libcrypto3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libssl3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
              • +
            • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
              • +
            + +
            + +
            + +

            NVD Description

            +

            Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

            +

            Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

            +

            Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

            +

            When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

            +

            For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

            +

            Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

            +

            Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

            +

            The OpenSSL SSL/TLS implementation is not affected by this issue.

            +

            The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

            +

            OpenSSL 3.1 and 3.0 are vulnerable to this issue.

            +

            Remediation

            +

            Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

            +

            References

            + + +
            + +
            +

            More about this vulnerability

            +
            + +
            diff --git a/docs/snyk/v2.8.4/argocd-test.html b/docs/snyk/v2.8.4/argocd-test.html deleted file mode 100644 index a1275415abd1f..0000000000000 --- a/docs/snyk/v2.8.4/argocd-test.html +++ /dev/null @@ -1,3684 +0,0 @@ - - - - - - - - - Snyk test report - - - - - - - - - -
            -
            -
            -
            - - - Snyk - Open Source Security - - - - - - - -
            -

            Snyk test report

            - -

            October 22nd 2023, 12:20:43 am (UTC+00:00)

            -
            -
            - Scanned the following paths: -
              -
            • /argo-cd/argoproj/argo-cd/v2 (gomodules)
            • /argo-cd (yarn)
              • -
            -
            - -
            -
            8 known vulnerabilities
            -
            162 vulnerable dependency paths
            -
            1851 dependencies
            -
            -
            -
            -
            - -
            -
            -
            -

            Denial of Service (DoS)

            -
            - -
            - high severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Vulnerable module: - - google.golang.org/grpc -
              • - -
            • Introduced through: - - github.com/argoproj/argo-cd/v2@0.0.0 and google.golang.org/grpc@1.56.1 - -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/health/grpc_health_v1@1.56.1 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/health@1.56.1 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/reflection@1.56.1 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.16.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.16.0 - › - go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig@1.16.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.16.0 - › - go.opentelemetry.io/proto/otlp/collector/trace/v1@0.19.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 - › - google.golang.org/grpc/health/grpc_health_v1@1.56.1 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/reflection@1.56.1 - › - google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.56.1 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/health@1.56.1 - › - google.golang.org/grpc/health/grpc_health_v1@1.56.1 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 - › - google.golang.org/grpc@1.56.1 - - - -
              • -
            - -
            - -
            - -

            Overview

            -

            google.golang.org/grpc is a Go implementation of gRPC

            -

            Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.

            -

            Remediation

            -

            Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

            -

            References

            - - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            Denial of Service (DoS)

            -
            - -
            - high severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Vulnerable module: - - golang.org/x/net/http2 -
              • - -
            • Introduced through: - - - github.com/argoproj/argo-cd/v2@0.0.0, k8s.io/apimachinery/pkg/util/net@0.24.2 and others -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/soheilhy/cmux@0.1.5 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/transport/spdy@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/pkg/kubeclientmetrics@#d56162821bd1 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/testing@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/plugin/pkg/client/auth/azure@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/plugin/pkg/client/auth/gcp@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/plugin/pkg/client/auth/oidc@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/record@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/health/grpc_health_v1@1.56.1 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.16.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/listers/core/v1@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/informers@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/clientcmd@0.24.2 - › - k8s.io/client-go/tools/auth@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/controller@#3446d4ae8520 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/discovery/fake@0.24.2 - › - k8s.io/client-go/testing@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/kubernetes/fake@0.24.2 - › - k8s.io/client-go/testing@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/remotecommand@0.24.2 - › - k8s.io/client-go/transport/spdy@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/pkg/apis/clientauthentication/v1beta1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/api/rbac/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/api/errors@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/common@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/api/equality@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/transport/spdy@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/pkg/kubeclientmetrics@#d56162821bd1 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/testing@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/plugin/pkg/client/auth/azure@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/plugin/pkg/client/auth/gcp@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/plugin/pkg/client/auth/oidc@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 - › - google.golang.org/grpc/health/grpc_health_v1@1.56.1 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/reflection@1.56.1 - › - google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.56.1 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - google.golang.org/grpc/health@1.56.1 - › - google.golang.org/grpc/health/grpc_health_v1@1.56.1 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/cache@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/api@#3446d4ae8520 - › - k8s.io/client-go/listers/core/v1@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/informers/core/v1@0.24.2 - › - k8s.io/client-go/listers/core/v1@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/cmd@#3446d4ae8520 - › - k8s.io/client-go/tools/clientcmd@0.24.2 - › - k8s.io/client-go/tools/auth@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/kubectl/pkg/util/term@0.24.2 - › - k8s.io/client-go/tools/remotecommand@0.24.2 - › - k8s.io/client-go/transport/spdy@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/Azure/kubelogin/pkg/token@0.0.20 - › - k8s.io/client-go/pkg/apis/clientauthentication/v1beta1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/resource@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/ignore@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/syncwaves@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/utils/testing@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/util/managedfields@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/scheme@0.11.0 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/kubectl/pkg/util/resource@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/health@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/util/retry@0.24.2 - › - k8s.io/apimachinery/pkg/api/errors@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/portforward@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1@0.24.2 - › - k8s.io/apimachinery/pkg/api/equality@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/api/validation@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/validation@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/discovery/fake@0.24.2 - › - k8s.io/client-go/testing@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/kubernetes/fake@0.24.2 - › - k8s.io/client-go/testing@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/remotecommand@0.24.2 - › - k8s.io/client-go/transport/spdy@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/health@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/common@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/controller/controllerutil@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client/apiutil@0.11.0 - › - k8s.io/client-go/restmapper@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/predicate@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/envtest@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/internal/testing/controlplane@0.11.0 - › - k8s.io/client-go/tools/clientcmd@0.24.2 - › - k8s.io/client-go/tools/auth@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/hook@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/resource@#425d65e07695 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/apimachinery/pkg/runtime/serializer@0.24.2 - › - k8s.io/apimachinery/pkg/runtime/serializer/versioning@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/listers/core/v1@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/informers@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/controller@#3446d4ae8520 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/record@0.24.2 - › - k8s.io/client-go/tools/reference@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/utils/kube/scheme@#425d65e07695 - › - k8s.io/apimachinery/pkg/util/managedfields@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/kubectl/pkg/util/term@0.24.2 - › - k8s.io/client-go/tools/remotecommand@0.24.2 - › - k8s.io/client-go/transport/spdy@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - k8s.io/client-go/transport@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 - › - github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 - › - google.golang.org/grpc@1.56.1 - › - google.golang.org/grpc/internal/transport@1.56.1 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/handler@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/runtime/inject@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/cache@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/cache/internal@0.11.0 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/kubernetes@0.24.2 - › - k8s.io/client-go/kubernetes/typed/storage/v1beta1@0.24.2 - › - k8s.io/client-go/applyconfigurations/storage/v1beta1@0.24.2 - › - k8s.io/client-go/applyconfigurations/meta/v1@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/builder@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/webhook/admission@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/webhook/internal/metrics@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/metrics@0.11.0 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/tools/clientcmd@0.24.2 - › - k8s.io/client-go/tools/clientcmd/api/latest@0.24.2 - › - k8s.io/apimachinery/pkg/runtime/serializer/versioning@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/api@#3446d4ae8520 - › - k8s.io/client-go/listers/core/v1@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/informers/core/v1@0.24.2 - › - k8s.io/client-go/listers/core/v1@0.24.2 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/diff@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/utils/kube/scheme@#425d65e07695 - › - k8s.io/apimachinery/pkg/util/managedfields@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/hook@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/hook/helm@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/common@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/syncwaves@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/hook/helm@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/common@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/manager@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/webhook@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/webhook/internal/metrics@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/metrics@0.11.0 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/source@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/source/internal@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/predicate@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/builder@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/webhook/conversion@0.11.0 - › - k8s.io/apimachinery/pkg/runtime/serializer@0.24.2 - › - k8s.io/apimachinery/pkg/runtime/serializer/versioning@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/envtest@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/webhook/conversion@0.11.0 - › - k8s.io/apimachinery/pkg/runtime/serializer@0.24.2 - › - k8s.io/apimachinery/pkg/runtime/serializer/versioning@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/cmd@#3446d4ae8520 - › - k8s.io/client-go/tools/clientcmd@0.24.2 - › - k8s.io/client-go/tools/clientcmd/api/latest@0.24.2 - › - k8s.io/apimachinery/pkg/runtime/serializer/versioning@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - k8s.io/client-go/kubernetes@0.24.2 - › - k8s.io/client-go/kubernetes/typed/storage/v1beta1@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/predicate@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync/ignore@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/hook@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/hook/helm@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/sync/common@#425d65e07695 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/controller@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/source@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/source/internal@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/predicate@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/client-go/rest@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/cache@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/sync@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/gitops-engine/pkg/utils/kube@#425d65e07695 - › - k8s.io/kubectl/pkg/util/openapi@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/handler@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/runtime/inject@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/cache@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/cache/internal@0.11.0 - › - k8s.io/client-go/tools/cache@0.24.2 - › - k8s.io/client-go/tools/pager@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/controller/controllerutil@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client/apiutil@0.11.0 - › - k8s.io/client-go/restmapper@0.24.2 - › - k8s.io/client-go/discovery@0.24.2 - › - k8s.io/client-go/kubernetes/scheme@0.24.2 - › - k8s.io/api/storage/v1beta1@0.24.2 - › - k8s.io/api/core/v1@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/source@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/source/internal@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/predicate@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - sigs.k8s.io/controller-runtime/pkg/controller@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/source@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/source/internal@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/predicate@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/event@0.11.0 - › - sigs.k8s.io/controller-runtime/pkg/client@0.11.0 - › - k8s.io/client-go/dynamic@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1/unstructured@0.24.2 - › - k8s.io/apimachinery/pkg/apis/meta/v1@0.24.2 - › - k8s.io/apimachinery/pkg/watch@0.24.2 - › - k8s.io/apimachinery/pkg/util/net@0.24.2 - › - golang.org/x/net/http2@0.11.0 - - - -
              • -
            - -
            - -
            - -

            Overview

            -

            golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

            -

            Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.

            -

            Remediation

            -

            Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

            -

            References

            - - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            LGPL-3.0 license

            -
            - -
            - medium severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Module: - - gopkg.in/retry.v1 -
              • - -
            • Introduced through: - - - github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/Azure/kubelogin/pkg/token@0.0.20 - › - gopkg.in/retry.v1@1.0.3 - - - -
              • -
            - -
            - -
            - -

            LGPL-3.0 license

            - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            MPL-2.0 license

            -
            - -
            - medium severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Module: - - github.com/r3labs/diff -
              • - -
            • Introduced through: - - github.com/argoproj/argo-cd/v2@0.0.0 and github.com/r3labs/diff@1.1.0 - -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/r3labs/diff@1.1.0 - - - -
              • -
            - -
            - -
            - -

            MPL-2.0 license

            - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            MPL-2.0 license

            -
            - -
            - medium severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Module: - - github.com/hashicorp/go-version -
              • - -
            • Introduced through: - - - github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.15.1 and others -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - code.gitea.io/sdk/gitea@0.15.1 - › - github.com/hashicorp/go-version@1.2.1 - - - -
              • -
            - -
            - -
            - -

            MPL-2.0 license

            - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            MPL-2.0 license

            -
            - -
            - medium severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Module: - - github.com/hashicorp/go-retryablehttp -
              • - -
            • Introduced through: - - github.com/argoproj/argo-cd/v2@0.0.0 and github.com/hashicorp/go-retryablehttp@0.7.4 - -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/xanzy/go-gitlab@0.86.0 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/cmd@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/api@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/controller@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - - - -
              • -
            - -
            - -
            - -

            MPL-2.0 license

            - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            MPL-2.0 license

            -
            - -
            - medium severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Module: - - github.com/hashicorp/go-cleanhttp -
              • - -
            • Introduced through: - - - github.com/argoproj/argo-cd/v2@0.0.0, github.com/hashicorp/go-retryablehttp@0.7.4 and others -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/xanzy/go-gitlab@0.86.0 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/xanzy/go-gitlab@0.86.0 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/cmd@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/api@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/argoproj/notifications-engine/pkg/controller@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 - › - github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 - › - github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 - › - github.com/hashicorp/go-retryablehttp@0.7.4 - › - github.com/hashicorp/go-cleanhttp@0.5.2 - - - -
              • -
            - -
            - -
            - -

            MPL-2.0 license

            - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -

            MPL-2.0 license

            -
            - -
            - medium severity -
            - -
            - -
              -
            • - Package Manager: golang -
              • -
            • - Module: - - github.com/gosimple/slug -
              • - -
            • Introduced through: - - github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1 - -
              • -
            - -
            - - -

            Detailed paths

            - -
              -
            • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/gosimple/slug@1.13.1 - - - -
              • -
            - -
            - -
            - -

            MPL-2.0 license

            - -
            - -
            -

            More about this vulnerability

            -
            - -
            -
            -
            -
            - - - diff --git a/docs/snyk/v2.8.4/argocd-iac-install.html b/docs/snyk/v2.8.5/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.8.4/argocd-iac-install.html rename to docs/snyk/v2.8.5/argocd-iac-install.html index 74bfd26bd5685..3d4dd5fd52b45 100644 --- a/docs/snyk/v2.8.4/argocd-iac-install.html +++ b/docs/snyk/v2.8.5/argocd-iac-install.html @@ -456,7 +456,7 @@

            Snyk test report

            -

            October 22nd 2023, 12:22:54 am (UTC+00:00)

            +

            October 29th 2023, 12:24:06 am (UTC+00:00)

            Scanned the following path: @@ -789,7 +789,7 @@

            Container could be running with outdated image

          • - Line number: 19755 + Line number: 19761
          @@ -1079,7 +1079,7 @@

          Container has no CPU limit

        • - Line number: 19498 + Line number: 19504
        @@ -1137,7 +1137,7 @@

        Container has no CPU limit

      • - Line number: 19755 + Line number: 19761
      @@ -1195,7 +1195,7 @@

      Container has no CPU limit

    • - Line number: 19555 + Line number: 19561
    @@ -1253,7 +1253,7 @@

    Container has no CPU limit

  • - Line number: 19840 + Line number: 19846
    • @@ -1311,7 +1311,7 @@

    Container has no CPU limit

  • - Line number: 20156 + Line number: 20162
    • @@ -1571,7 +1571,7 @@

    Container is running without liveness probe

  • - Line number: 19498 + Line number: 19504
    • @@ -1623,7 +1623,7 @@

    Container is running without liveness probe

  • - Line number: 19755 + Line number: 19761
    • @@ -1913,7 +1913,7 @@

    Container is running without memory limit

  • - Line number: 19498 + Line number: 19504
    • @@ -1971,7 +1971,7 @@

    Container is running without memory limit

  • - Line number: 19755 + Line number: 19761
    • @@ -2029,7 +2029,7 @@

    Container is running without memory limit

  • - Line number: 19555 + Line number: 19561
    • @@ -2087,7 +2087,7 @@

    Container is running without memory limit

  • - Line number: 19840 + Line number: 19846
    • @@ -2145,7 +2145,7 @@

    Container is running without memory limit

  • - Line number: 20156 + Line number: 20162
    • @@ -2369,7 +2369,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19432 + Line number: 19438
    • @@ -2425,7 +2425,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19508 + Line number: 19514
    • @@ -2481,7 +2481,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19762 + Line number: 19768
    • @@ -2537,7 +2537,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19728 + Line number: 19734
    • @@ -2593,7 +2593,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 20066 + Line number: 20072
    • @@ -2649,7 +2649,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 20304 + Line number: 20310
    • diff --git a/docs/snyk/v2.8.4/argocd-iac-namespace-install.html b/docs/snyk/v2.8.5/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.8.4/argocd-iac-namespace-install.html rename to docs/snyk/v2.8.5/argocd-iac-namespace-install.html index ad9dd5a08070e..aae75827ee40d 100644 --- a/docs/snyk/v2.8.4/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.8.5/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:23:05 am (UTC+00:00)

    +

    October 29th 2023, 12:24:17 am (UTC+00:00)

    Scanned the following path: @@ -789,7 +789,7 @@

    Container could be running with outdated image

  • - Line number: 1261 + Line number: 1267
    • @@ -1079,7 +1079,7 @@

    Container has no CPU limit

  • - Line number: 1004 + Line number: 1010
    • @@ -1137,7 +1137,7 @@

    Container has no CPU limit

  • - Line number: 1261 + Line number: 1267
    • @@ -1195,7 +1195,7 @@

    Container has no CPU limit

  • - Line number: 1061 + Line number: 1067
    • @@ -1253,7 +1253,7 @@

    Container has no CPU limit

  • - Line number: 1346 + Line number: 1352
    • @@ -1311,7 +1311,7 @@

    Container has no CPU limit

  • - Line number: 1662 + Line number: 1668
    • @@ -1571,7 +1571,7 @@

    Container is running without liveness probe

  • - Line number: 1004 + Line number: 1010
    • @@ -1623,7 +1623,7 @@

    Container is running without liveness probe

  • - Line number: 1261 + Line number: 1267
    • @@ -1913,7 +1913,7 @@

    Container is running without memory limit

  • - Line number: 1004 + Line number: 1010
    • @@ -1971,7 +1971,7 @@

    Container is running without memory limit

  • - Line number: 1261 + Line number: 1267
    • @@ -2029,7 +2029,7 @@

    Container is running without memory limit

  • - Line number: 1061 + Line number: 1067
    • @@ -2087,7 +2087,7 @@

    Container is running without memory limit

  • - Line number: 1346 + Line number: 1352
    • @@ -2145,7 +2145,7 @@

    Container is running without memory limit

  • - Line number: 1662 + Line number: 1668
    • @@ -2369,7 +2369,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 938 + Line number: 944
    • @@ -2425,7 +2425,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1014 + Line number: 1020
    • @@ -2481,7 +2481,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1268 + Line number: 1274
    • @@ -2537,7 +2537,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1234 + Line number: 1240
    • @@ -2593,7 +2593,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1572 + Line number: 1578
    • @@ -2649,7 +2649,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1810 + Line number: 1816
    • diff --git a/docs/snyk/v2.8.5/argocd-test.html b/docs/snyk/v2.8.5/argocd-test.html new file mode 100644 index 0000000000000..3a5f08a08b860 --- /dev/null +++ b/docs/snyk/v2.8.5/argocd-test.html @@ -0,0 +1,1031 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    October 29th 2023, 12:21:29 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • /argo-cd/argoproj/argo-cd/v2 (gomodules)
    • /argo-cd (yarn)
      • +
    +
    + +
    +
    6 known vulnerabilities
    +
    19 vulnerable dependency paths
    +
    1853 dependencies
    +
    +
    +
    +
    + +
    +
    +
    +

    LGPL-3.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Module: + + gopkg.in/retry.v1 +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/Azure/kubelogin/pkg/token@0.0.20 + › + gopkg.in/retry.v1@1.0.3 + + + +
      • +
    + +
    + +
    + +

    LGPL-3.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/r3labs/diff +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/r3labs/diff@1.1.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/r3labs/diff@1.1.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-version +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.15.1 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + code.gitea.io/sdk/gitea@0.15.1 + › + github.com/hashicorp/go-version@1.2.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-retryablehttp +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/hashicorp/go-retryablehttp@0.7.4 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/xanzy/go-gitlab@0.86.0 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/cmd@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/api@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/controller@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-cleanhttp +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/hashicorp/go-retryablehttp@0.7.4 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/xanzy/go-gitlab@0.86.0 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/xanzy/go-gitlab@0.86.0 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/cmd@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/api@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/controller@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#3446d4ae8520 + › + github.com/argoproj/notifications-engine/pkg/services@#3446d4ae8520 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/gosimple/slug +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/gosimple/slug@1.13.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +
    +
    + + + diff --git a/docs/snyk/v2.9.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.8.5/ghcr.io_dexidp_dex_v2.37.0.html similarity index 91% rename from docs/snyk/v2.9.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html rename to docs/snyk/v2.8.5/ghcr.io_dexidp_dex_v2.37.0.html index 395c6ba1691e8..74f7da7894829 100644 --- a/docs/snyk/v2.9.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html +++ b/docs/snyk/v2.8.5/ghcr.io_dexidp_dex_v2.37.0.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:17:57 am (UTC+00:00)

    +

    October 29th 2023, 12:21:38 am (UTC+00:00)

    Scanned the following paths: @@ -466,8 +466,8 @@

    Snyk test report

    -
    27 known vulnerabilities
    -
    72 vulnerable dependency paths
    +
    28 known vulnerabilities
    +
    79 vulnerable dependency paths
    786 dependencies

    @@ -648,12 +648,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

      +
    • Github Commit
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
      • +
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
      • +
    • GitHub Commit
    • Snyk Blog
    • Vulnerability Discovery
    • Vulnerability Explanation
      • @@ -731,12 +734,15 @@

      Remediation

      Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

      References

      @@ -2679,6 +2686,174 @@

      Detailed paths

      +
      +

      CVE-2023-5363

      +
      + +
      + low severity +
      + +
      + +
        +
      • + Package Manager: alpine:3.18 +
        • +
      • + Vulnerable module: + + openssl/libcrypto3 +
        • + +
      • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.37.0 and openssl/libcrypto3@3.1.1-r1 + +
        • +
      + +
      + + +

      Detailed paths

      + +
        +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
        • +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
        • +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
        • +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
        • +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libssl3@3.1.1-r1 + + + +
        • +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
        • +
      • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
        • +
      + +
      + +
      + +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

      +

      Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

      +

      Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

      +

      When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

      +

      For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

      +

      Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

      +

      Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

      +

      The OpenSSL SSL/TLS implementation is not affected by this issue.

      +

      The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

      +

      OpenSSL 3.1 and 3.0 are vulnerable to this issue.

      +

      Remediation

      +

      Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

      +

      References

      + + +
      + +
      +

      More about this vulnerability

      +
      + +
      diff --git a/docs/snyk/v2.8.4/haproxy_2.6.14-alpine.html b/docs/snyk/v2.8.5/haproxy_2.6.14-alpine.html similarity index 53% rename from docs/snyk/v2.8.4/haproxy_2.6.14-alpine.html rename to docs/snyk/v2.8.5/haproxy_2.6.14-alpine.html index d69638239b8f3..020d8275f0dad 100644 --- a/docs/snyk/v2.8.4/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.8.5/haproxy_2.6.14-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

      Snyk test report

      -

      October 22nd 2023, 12:20:56 am (UTC+00:00)

      +

      October 29th 2023, 12:21:43 am (UTC+00:00)

      Scanned the following path: @@ -466,8 +466,8 @@

      Snyk test report

      -
      0 known vulnerabilities
      -
      0 vulnerable dependency paths
      +
      1 known vulnerabilities
      +
      9 vulnerable dependency paths
      18 dependencies
      @@ -484,7 +484,198 @@

      Snyk test report

      - No known vulnerabilities detected. +
      +
      +

      CVE-2023-5363

      +
      + +
      + low severity +
      + +
      + +
        +
      • + Package Manager: alpine:3.18 +
        • +
      • + Vulnerable module: + + openssl/libcrypto3 +
        • + +
      • Introduced through: + + docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.2-r0 + +
        • +
      + +
      + + +

      Detailed paths

      + +
        +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libcrypto3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libcrypto3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + › + openssl/libcrypto3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libssl3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
        • +
      • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
        • +
      + +
      + +
      + +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

      +

      Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

      +

      Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

      +

      When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

      +

      For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

      +

      Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

      +

      Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

      +

      The OpenSSL SSL/TLS implementation is not affected by this issue.

      +

      The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

      +

      OpenSSL 3.1 and 3.0 are vulnerable to this issue.

      +

      Remediation

      +

      Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

      +

      References

      + + +
      + +
      +

      More about this vulnerability

      +
      + +
      +
      diff --git a/docs/snyk/v2.9.0-rc2/quay.io_argoproj_argocd_v2.9.0-rc2.html b/docs/snyk/v2.8.5/quay.io_argoproj_argocd_v2.8.5.html similarity index 66% rename from docs/snyk/v2.9.0-rc2/quay.io_argoproj_argocd_v2.9.0-rc2.html rename to docs/snyk/v2.8.5/quay.io_argoproj_argocd_v2.8.5.html index 1bf83c3e87170..eb2bb47c67fc8 100644 --- a/docs/snyk/v2.9.0-rc2/quay.io_argoproj_argocd_v2.9.0-rc2.html +++ b/docs/snyk/v2.8.5/quay.io_argoproj_argocd_v2.8.5.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

      Snyk test report

      -

      October 22nd 2023, 12:18:24 am (UTC+00:00)

      +

      October 29th 2023, 12:22:15 am (UTC+00:00)

      Scanned the following paths:
        -
      • quay.io/argoproj/argocd:v2.9.0-rc2/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.9.0-rc2/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.9.0-rc2/kustomize/kustomize/v5 (gomodules)
      • quay.io/argoproj/argocd:v2.9.0-rc2/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.9.0-rc2/git-lfs/git-lfs (gomodules)
        • +
      • quay.io/argoproj/argocd:v2.8.5/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.8.5/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.8.5/kustomize/kustomize/v5 (gomodules)
      • quay.io/argoproj/argocd:v2.8.5/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.8.5/git-lfs/git-lfs (gomodules)
      -
      39 known vulnerabilities
      -
      148 vulnerable dependency paths
      -
      2270 dependencies
      +
      29 known vulnerabilities
      +
      97 vulnerable dependency paths
      +
      2117 dependencies
      @@ -476,80 +476,6 @@

      Snyk test report

      -
      -

      Denial of Service (DoS)

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: golang -
        • -
      • - Vulnerable module: - - google.golang.org/grpc -
        • - -
      • Introduced through: - - github.com/argoproj/argo-cd/v2@* and google.golang.org/grpc@v1.56.2 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - github.com/argoproj/argo-cd/v2@* - › - google.golang.org/grpc@v1.56.2 - - - -
        • -
      - -
      - -
      - -

      Overview

      -

      google.golang.org/grpc is a Go implementation of gRPC

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.

      -

      Remediation

      -

      Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -

      Denial of Service (DoS)

      @@ -572,7 +498,7 @@

      Denial of Service (DoS)

    • Introduced through: - github.com/argoproj/argo-cd/v2@* and golang.org/x/net/http2@v0.15.0 + helm.sh/helm/v3@* and golang.org/x/net/http2@v0.8.0
    @@ -583,15 +509,6 @@

    Denial of Service (DoS)

    Detailed paths

      -
    • - Introduced through: - github.com/argoproj/argo-cd/v2@* - › - golang.org/x/net/http2@v0.15.0 - - - -
    • Introduced through: helm.sh/helm/v3@* @@ -614,12 +531,15 @@

      Remediation

      Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

      References

        +
      • Github Commit
      • GitHub Commit
      • GitHub Commit
      • GitHub Commit
        • +
      • GitHub Commit
      • GitHub Commit
      • GitHub Commit
      • GitHub Commit
        • +
      • GitHub Commit
      • Snyk Blog
      • Vulnerability Discovery
      • Vulnerability Explanation
        • @@ -632,104 +552,6 @@

        References

        More about this vulnerability

        - -
        -

        Out-of-bounds Write

        -
        - -
        - high severity -
        - -
        - -
          -
        • - Package Manager: ubuntu:22.04 -
          • -
        • - Vulnerable module: - - glibc/libc-bin -
          • - -
        • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and glibc/libc-bin@2.35-0ubuntu3.3 - -
          • -
        - -
        - - -

        Detailed paths

        - -
          -
        • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - glibc/libc-bin@2.35-0ubuntu3.3 - - - -
          • -
        • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - glibc/libc6@2.35-0ubuntu3.3 - - - -
          • -
        - -
        - -
        - -

        NVD Description

        -

        Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

        -

        A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

        -

        Remediation

        -

        Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.4 or higher.

        -

        References

        - - -
        - -
        -

        More about this vulnerability

        -
        -

        Directory Traversal

        @@ -817,87 +639,6 @@

        References

        More about this vulnerability

        - -
        -

        Heap-based Buffer Overflow

        -
        - -
        - high severity -
        - -
        - -
          -
        • - Package Manager: ubuntu:22.04 -
          • -
        • - Vulnerable module: - - curl/libcurl3-gnutls -
          • - -
        • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2, git@1:2.34.1-1ubuntu1.10 and others -
          • -
        - -
        - - -

        Detailed paths

        - -
          -
        • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - - - -
          • -
        - -
        - -
        - -

        NVD Description

        -

        Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

        -

        This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy - handshake.

        -

        When curl is asked to pass along the host name to the SOCKS5 proxy to allow - that to resolve the address instead of it getting done by curl itself, the - maximum length that host name can be is 255 bytes.

        -

        If the host name is detected to be longer, curl switches to local name - resolving and instead passes on the resolved address only. Due to this bug, - the local variable that means "let the host resolve the name" could get the - wrong value during a slow SOCKS5 handshake, and contrary to the intention, - copy the too long host name to the target buffer instead of copying just the - resolved address there.

        -

        The target buffer being a heap based buffer, and the host name coming from the - URL that curl has been told to operate with.

        -

        Remediation

        -

        Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.14 or higher.

        -

        References

        - - -
        - -
        -

        More about this vulnerability

        -
        -

        CVE-2020-22916

        @@ -921,7 +662,7 @@

        CVE-2020-22916

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and xz-utils/liblzma5@5.2.5-2ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.8.5 and xz-utils/liblzma5@5.2.5-2ubuntu1
      @@ -934,7 +675,7 @@

      Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › xz-utils/liblzma5@5.2.5-2ubuntu1 @@ -995,7 +736,7 @@

        Out-of-bounds Write

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2, git@1:2.34.1-1ubuntu1.10 and others + docker-image|quay.io/argoproj/argocd@v2.8.5, git@1:2.34.1-1ubuntu1.10 and others
      @@ -1007,7 +748,7 @@

      Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › @@ -1020,7 +761,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › @@ -1035,7 +776,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › @@ -1048,7 +789,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › @@ -1059,7 +800,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › perl/perl-base@5.34.0-3ubuntu1.2 @@ -1093,7 +834,7 @@

        References

        -

        Out-of-bounds Read

        +

        Access of Uninitialized Pointer

        @@ -1109,12 +850,12 @@

        Out-of-bounds Read

      • Vulnerable module: - libx11/libx11-data + krb5/libk5crypto3
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and libx11/libx11-data@2:1.7.5-1ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.8.5 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
      @@ -1127,477 +868,114 @@

      Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 + krb5/libk5crypto3@1.19.2-2ubuntu0.2
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 + krb5/libk5crypto3@1.19.2-2ubuntu0.2
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 + › + krb5/libkrb5-3@1.19.2-2ubuntu0.2 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libk5crypto3@1.19.2-2ubuntu0.2
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - libxext/libxext6@2:1.3.4-1build1 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libkrb5-3@1.19.2-2ubuntu0.2
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 › - libxmu/libxmuu1@2:1.1.3-3 + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libkrb5-3@1.19.2-2ubuntu0.2
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - xauth@1:1.1-1build2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
        • -
      - - - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.

      -

      Remediation

      -

      Upgrade Ubuntu:22.04 libx11 to version 2:1.7.5-1ubuntu0.3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - - -
      -

      Loop with Unreachable Exit Condition ('Infinite Loop')

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - libx11/libx11-data -
        • - -
      • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and libx11/libx11-data@2:1.7.5-1ubuntu0.2 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libxext/libxext6@2:1.3.4-1build1 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libxmu/libxmuu1@2:1.1.3-3 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - xauth@1:1.1-1build2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

      -

      Remediation

      -

      Upgrade Ubuntu:22.04 libx11 to version 2:1.7.5-1ubuntu0.3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Integer Overflow or Wraparound

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - libx11/libx11-data -
        • - -
      • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and libx11/libx11-data@2:1.7.5-1ubuntu0.2 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libxext/libxext6@2:1.3.4-1build1 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libxmu/libxmuu1@2:1.1.3-3 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - xauth@1:1.1-1build2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.

      -

      Remediation

      -

      Upgrade Ubuntu:22.04 libx11 to version 2:1.7.5-1ubuntu0.3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Access of Uninitialized Pointer

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - krb5/libk5crypto3 -
        • - -
      • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - krb5/libk5crypto3@1.19.2-2ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libk5crypto3@1.19.2-2ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - krb5/libk5crypto3@1.19.2-2ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + openssh/openssh-client@1:8.9p1-3ubuntu0.4 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 + +
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -1606,11 +984,11 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 › @@ -1621,7 +999,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › adduser@3.118ubuntu5 › @@ -1640,7 +1018,7 @@

        Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › krb5/libkrb5support0@1.19.2-2ubuntu0.2 @@ -1667,6 +1045,7 @@

        References

      • cve@mitre.org
      • cve@mitre.org
      • cve@mitre.org
        • +
      • cve@mitre.org
      @@ -1755,7 +1134,7 @@

      Memory Leak

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and glibc/libc-bin@2.35-0ubuntu3.3 + docker-image|quay.io/argoproj/argocd@v2.8.5 and glibc/libc-bin@2.35-0ubuntu3.4
    @@ -1768,18 +1147,18 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - glibc/libc-bin@2.35-0ubuntu3.3 + glibc/libc-bin@2.35-0ubuntu3.4
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - glibc/libc6@2.35-0ubuntu3.3 + glibc/libc6@2.35-0ubuntu3.4 @@ -2102,258 +1481,28 @@

      Detailed paths

      -

      MPL-2.0 license

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: golang -
        • -
      • - Module: - - github.com/gosimple/slug -
        • - -
      • Introduced through: - - github.com/argoproj/argo-cd/v2@* and github.com/gosimple/slug@v1.13.1 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - github.com/argoproj/argo-cd/v2@* - › - github.com/gosimple/slug@v1.13.1 - - - -
        • -
      - -
      - -
      - -

      MPL-2.0 license

      - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      CVE-2022-46908

      -
      - -
      - low severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - sqlite3/libsqlite3-0 -
        • - -
      • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2, gnupg2/gpg@2.2.27-3ubuntu2.1 and others -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - gnupg2/gpg@2.2.27-3ubuntu2.1 - › - sqlite3/libsqlite3-0@3.37.2-2ubuntu0.1 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu:22.04. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

      -

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 sqlite3.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Arbitrary Code Injection

      -
      - -
      - low severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - shadow/passwd -
        • - -
      • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and shadow/passwd@1:4.8.1-2ubuntu2.1 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - shadow/login@1:4.8.1-2ubuntu2.1 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu:22.04. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

      -

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 shadow.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Out-of-bounds Write

      +

      MPL-2.0 license

      -
      - low severity +
      + medium severity
      • - Package Manager: ubuntu:22.04 + Package Manager: golang
      • - Vulnerable module: + Module: - procps/libprocps8 + github.com/gosimple/slug
      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and procps/libprocps8@2:3.3.17-6ubuntu2 + github.com/argoproj/argo-cd/v2@* and github.com/gosimple/slug@v1.13.1
      @@ -2366,29 +1515,9 @@

      Detailed paths

      • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - procps/libprocps8@2:3.3.17-6ubuntu2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - procps@2:3.3.17-6ubuntu2 - › - procps/libprocps8@2:3.3.17-6ubuntu2 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + github.com/argoproj/argo-cd/v2@* › - procps@2:3.3.17-6ubuntu2 + github.com/gosimple/slug@v1.13.1 @@ -2399,28 +1528,17 @@

        Detailed paths

        -

        NVD Description

        -

        Note: Versions mentioned in the description apply only to the upstream procps package and not the procps package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

        -

        Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

        -

        Remediation

        -

        There is no fixed version for Ubuntu:22.04 procps.

        -

        References

        - +

        MPL-2.0 license

        -

        More about this vulnerability

        +

        More about this vulnerability

      -

      Uncontrolled Recursion

      +

      CVE-2022-46908

      @@ -2436,13 +1554,13 @@

      Uncontrolled Recursion

    • Vulnerable module: - pcre3/libpcre3 + sqlite3/libsqlite3-0
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.8.5, gnupg2/gpg@2.2.27-3ubuntu2.1 and others
    @@ -2454,20 +1572,11 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - grep@3.7-1build1 + gnupg2/gpg@2.2.27-3ubuntu2.1 › - pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + sqlite3/libsqlite3-0@3.37.2-2ubuntu0.1 @@ -2479,32 +1588,29 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

      +

      SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 pcre3.

      +

      There is no fixed version for Ubuntu:22.04 sqlite3.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      -

      Release of Invalid Pointer or Reference

      +

      Arbitrary Code Injection

      @@ -2520,12 +1626,12 @@

      Release of Invalid Pointer or Reference

    • Vulnerable module: - patch + shadow/passwd
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.8.5 and shadow/passwd@1:4.8.1-2ubuntu2.1
    @@ -2538,9 +1644,40 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - patch@2.7.6-7build2 + shadow/passwd@1:4.8.1-2ubuntu2.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + openssh/openssh-client@1:8.9p1-3ubuntu0.4 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + shadow/login@1:4.8.1-2ubuntu2.1 @@ -2552,26 +1689,29 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

      +

      In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 patch.

      +

      There is no fixed version for Ubuntu:22.04 shadow.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      -

      Double Free

      +

      Out-of-bounds Write

      @@ -2587,12 +1727,12 @@

      Double Free

    • Vulnerable module: - patch + procps/libprocps8
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.8.5 and procps/libprocps8@2:3.3.17-6ubuntu2
    @@ -2605,9 +1745,29 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - patch@2.7.6-7build2 + procps/libprocps8@2:3.3.17-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + procps@2:3.3.17-6ubuntu2 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.5 + › + procps@2:3.3.17-6ubuntu2 @@ -2619,31 +1779,27 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream procps package and not the procps package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

      +

      Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 patch.

      +

      There is no fixed version for Ubuntu:22.04 procps.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      -

      Improper Authentication

      +

      Uncontrolled Recursion

      @@ -2659,12 +1815,12 @@

      Improper Authentication

    • Vulnerable module: - openssl/libssl3 + pcre3/libpcre3
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and openssl/libssl3@3.0.2-0ubuntu1.10 + docker-image|quay.io/argoproj/argocd@v2.8.5 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    @@ -2677,113 +1833,20 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - openssl@3.0.2-0ubuntu1.10 + pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - ca-certificates@20230311ubuntu0.22.04.1 + grep@3.7-1build1 › - openssl@3.0.2-0ubuntu1.10 + pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 @@ -2795,47 +1858,32 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Issue summary: The AES-SIV cipher implementation contains a bug that causes - it to ignore empty associated data entries which are unauthenticated as - a consequence.

      -

      Impact summary: Applications that use the AES-SIV algorithm and want to - authenticate empty data entries as associated data can be mislead by removing - adding or reordering such empty entries as these are ignored by the OpenSSL - implementation. We are currently unaware of any such applications.

      -

      The AES-SIV algorithm allows for authentication of multiple associated - data entries along with the encryption. To authenticate empty data the - application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with - NULL pointer as the output buffer and 0 as the input buffer length. - The AES-SIV implementation in OpenSSL just returns success for such a call - instead of performing the associated data authentication operation. - The empty data thus will not be authenticated.

      -

      As this issue does not affect non-empty associated data authentication and - we expect it to be rare for an application to use empty associated data - entries this is qualified as Low severity issue.

      +

      In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      There is no fixed version for Ubuntu:22.04 pcre3.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      -

      Inefficient Regular Expression Complexity

      +

      Release of Invalid Pointer or Reference

      @@ -2851,12 +1899,12 @@

      Inefficient Regular Expression Complexity

    • Vulnerable module: - openssl/libssl3 + patch
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and openssl/libssl3@3.0.2-0ubuntu1.10 + docker-image|quay.io/argoproj/argocd@v2.8.5 and patch@2.7.6-7build2
    @@ -2869,113 +1917,9 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 + patch@2.7.6-7build2 @@ -2987,57 +1931,26 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. +

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Issue summary: Checking excessively long DH keys or parameters may be very slow.

      -

      Impact summary: Applications that use the functions DH_check(), DH_check_ex() - or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long - delays. Where the key or parameters that are being checked have been obtained - from an untrusted source this may lead to a Denial of Service.

      -

      The function DH_check() performs various checks on DH parameters. One of those - checks confirms that the modulus ('p' parameter) is not too large. Trying to use - a very large modulus is slow and OpenSSL will not normally use a modulus which - is over 10,000 bits in length.

      -

      However the DH_check() function checks numerous aspects of the key or parameters - that have been supplied. Some of those checks use the supplied modulus value - even if it has already been found to be too large.

      -

      An application that calls DH_check() and supplies a key or parameters obtained - from an untrusted source could be vulernable to a Denial of Service attack.

      -

      The function DH_check() is itself called by a number of other OpenSSL functions. - An application calling any of those other functions may similarly be affected. - The other functions affected by this are DH_check_ex() and - EVP_PKEY_param_check().

      -

      Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications - when using the '-check' option.

      -

      The OpenSSL SSL/TLS implementation is not affected by this issue. - The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

      +

      An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      There is no fixed version for Ubuntu:22.04 patch.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      -

      Excessive Iteration

      +

      Double Free

      @@ -3053,12 +1966,12 @@

      Excessive Iteration

    • Vulnerable module: - openssl/libssl3 + patch
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and openssl/libssl3@3.0.2-0ubuntu1.10 + docker-image|quay.io/argoproj/argocd@v2.8.5 and patch@2.7.6-7build2
    @@ -3071,113 +1984,9 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - ca-certificates@20230311ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - openssl@3.0.2-0ubuntu1.10 + patch@2.7.6-7build2 @@ -3189,50 +1998,26 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. +

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Issue summary: Checking excessively long DH keys or parameters may be very slow.

      -

      Impact summary: Applications that use the functions DH_check(), DH_check_ex() - or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long - delays. Where the key or parameters that are being checked have been obtained - from an untrusted source this may lead to a Denial of Service.

      -

      The function DH_check() performs various checks on DH parameters. After fixing - CVE-2023-3446 it was discovered that a large q parameter value can also trigger - an overly long computation during some of these checks. A correct q value, - if present, cannot be larger than the modulus p parameter, thus it is - unnecessary to perform these checks if q is larger than p.

      -

      An application that calls DH_check() and supplies a key or parameters obtained - from an untrusted source could be vulnerable to a Denial of Service attack.

      -

      The function DH_check() is itself called by a number of other OpenSSL functions. - An application calling any of those other functions may similarly be affected. - The other functions affected by this are DH_check_ex() and - EVP_PKEY_param_check().

      -

      Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications - when using the "-check" option.

      -

      The OpenSSL SSL/TLS implementation is not affected by this issue.

      -

      The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

      +

      A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      There is no fixed version for Ubuntu:22.04 patch.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      @@ -3258,7 +2043,7 @@

      CVE-2023-28531

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and openssh/openssh-client@1:8.9p1-3ubuntu0.4 + docker-image|quay.io/argoproj/argocd@v2.8.5 and openssh/openssh-client@1:8.9p1-3ubuntu0.4
    @@ -3271,7 +2056,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › openssh/openssh-client@1:8.9p1-3ubuntu0.4 @@ -3328,7 +2113,7 @@

      NULL Pointer Dereference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.8.5, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others
    @@ -3340,7 +2125,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -3351,11 +2136,11 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › openldap/libldap-2.5-0@2.5.16+dfsg-0ubuntu0.22.04.1 @@ -3364,7 +2149,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › openldap/libldap-common@2.5.16+dfsg-0ubuntu0.22.04.1 @@ -3426,7 +2211,7 @@

      Resource Exhaustion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and libzstd/libzstd1@1.4.8+dfsg-3build1 + docker-image|quay.io/argoproj/argocd@v2.8.5 and libzstd/libzstd1@1.4.8+dfsg-3build1
    @@ -3439,7 +2224,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › libzstd/libzstd1@1.4.8+dfsg-3build1 @@ -3497,7 +2282,7 @@

      Integer Overflow or Wraparound

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.8.5 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -3510,7 +2295,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › krb5/libk5crypto3@1.19.2-2ubuntu0.2 @@ -3519,7 +2304,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › adduser@3.118ubuntu5 › @@ -3540,7 +2325,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › adduser@3.118ubuntu5 › @@ -3563,7 +2348,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › krb5/libkrb5-3@1.19.2-2ubuntu0.2 @@ -3572,7 +2357,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › adduser@3.118ubuntu5 › @@ -3593,7 +2378,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -3602,7 +2387,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › openssh/openssh-client@1:8.9p1-3ubuntu0.4 › @@ -3613,11 +2398,11 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -3626,11 +2411,11 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 › @@ -3641,7 +2426,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › adduser@3.118ubuntu5 › @@ -3660,7 +2445,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › krb5/libkrb5support0@1.19.2-2ubuntu0.2 @@ -3717,7 +2502,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and gnupg2/gpgv@2.2.27-3ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.8.5 and gnupg2/gpgv@2.2.27-3ubuntu2.1
    @@ -3730,7 +2515,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpgv@2.2.27-3ubuntu2.1 @@ -3739,7 +2524,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › apt@2.4.10 › @@ -3750,7 +2535,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3761,7 +2546,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -3772,7 +2557,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -3783,7 +2568,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3796,7 +2581,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3809,7 +2594,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 @@ -3818,7 +2603,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3829,7 +2614,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3842,7 +2627,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1 @@ -3851,7 +2636,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3862,7 +2647,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 @@ -3871,7 +2656,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3882,7 +2667,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpg@2.2.27-3ubuntu2.1 @@ -3891,7 +2676,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3902,7 +2687,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3915,7 +2700,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3928,7 +2713,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 @@ -3937,7 +2722,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3948,7 +2733,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3961,7 +2746,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3974,7 +2759,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 @@ -3983,7 +2768,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3994,7 +2779,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 @@ -4003,7 +2788,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -4014,7 +2799,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 @@ -4023,7 +2808,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -4034,7 +2819,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gnupg2/gnupg@2.2.27-3ubuntu2.1 @@ -4093,7 +2878,7 @@

      Allocation of Resources Without Limits or Throttling

      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and glibc/libc-bin@2.35-0ubuntu3.3 + docker-image|quay.io/argoproj/argocd@v2.8.5 and glibc/libc-bin@2.35-0ubuntu3.4
    @@ -4106,18 +2891,18 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - glibc/libc-bin@2.35-0ubuntu3.3 + glibc/libc-bin@2.35-0ubuntu3.4
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › - glibc/libc6@2.35-0ubuntu3.3 + glibc/libc6@2.35-0ubuntu3.4 @@ -4172,7 +2957,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2, git@1:2.34.1-1ubuntu1.10 and others + docker-image|quay.io/argoproj/argocd@v2.8.5, git@1:2.34.1-1ubuntu1.10 and others
    @@ -4184,7 +2969,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 › @@ -4195,7 +2980,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git@1:2.34.1-1ubuntu1.10 @@ -4204,7 +2989,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › git-lfs@3.0.2-1ubuntu0.2 › @@ -4261,7 +3046,7 @@

      Uncontrolled Recursion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04 + docker-image|quay.io/argoproj/argocd@v2.8.5 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
    @@ -4274,7 +3059,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04 @@ -4283,7 +3068,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › apt@2.4.10 › @@ -4294,7 +3079,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › apt@2.4.10 › @@ -4307,7 +3092,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gcc-12/gcc-12-base@12.3.0-1ubuntu1~22.04 @@ -4316,7 +3101,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › gcc-12/libgcc-s1@12.3.0-1ubuntu1~22.04 @@ -4349,89 +3134,6 @@

      References

      More about this vulnerability

      - -
      -

      CVE-2023-38546

      -
      - -
      - low severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - curl/libcurl3-gnutls -
        • - -
      • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2, git@1:2.34.1-1ubuntu1.10 and others -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      This flaw allows an attacker to insert cookies at will into a running program - using libcurl, if the specific series of conditions are met.

      -

      libcurl performs transfers. In its API, an application creates "easy handles" - that are the individual handles for single transfers.

      -

      libcurl provides a function call that duplicates en easy handle called - curl_easy_duphandle.

      -

      If a transfer has cookies enabled when the handle is duplicated, the - cookie-enable state is also cloned - but without cloning the actual - cookies. If the source handle did not read any cookies from a specific file on - disk, the cloned version of the handle would instead store the file name as - none (using the four ASCII letters, no quotes).

      -

      Subsequent use of the cloned handle that does not explicitly set a source to - load cookies from would then inadvertently load cookies from a file named - none - if such a file exists and is readable in the current directory of the - program using libcurl. And if using the correct file format of course.

      -

      Remediation

      -

      Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.14 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      -

      Improper Input Validation

      @@ -4455,7 +3157,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and coreutils@8.32-4.1ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.8.5 and coreutils@8.32-4.1ubuntu1
    @@ -4468,7 +3170,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › coreutils@8.32-4.1ubuntu1 @@ -4525,7 +3227,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 and bash@5.1-6ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.8.5 and bash@5.1-6ubuntu1
    @@ -4538,7 +3240,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.9.0-rc2 + docker-image|quay.io/argoproj/argocd@v2.8.5 › bash@5.1-6ubuntu1 diff --git a/docs/snyk/v2.9.0-rc2/redis_7.0.11-alpine.html b/docs/snyk/v2.8.5/redis_7.0.11-alpine.html similarity index 81% rename from docs/snyk/v2.9.0-rc2/redis_7.0.11-alpine.html rename to docs/snyk/v2.8.5/redis_7.0.11-alpine.html index 329d39f6c5098..20730eb214f1d 100644 --- a/docs/snyk/v2.9.0-rc2/redis_7.0.11-alpine.html +++ b/docs/snyk/v2.8.5/redis_7.0.11-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

      Snyk test report

      -

      October 22nd 2023, 12:18:30 am (UTC+00:00)

      +

      October 29th 2023, 12:22:23 am (UTC+00:00)

      Scanned the following path: @@ -466,8 +466,8 @@

      Snyk test report

      -
      4 known vulnerabilities
      -
      32 vulnerable dependency paths
      +
      5 known vulnerabilities
      +
      41 vulnerable dependency paths
      18 dependencies
      @@ -1127,6 +1127,7 @@

      References

    • openssl-security@openssl.org
    • openssl-security@openssl.org
    • openssl-security@openssl.org
      • +
    • openssl-security@openssl.org
    @@ -1136,6 +1137,196 @@

    References

    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/snyk/v2.9.0-rc2/argocd-iac-install.html b/docs/snyk/v2.9.0-rc3/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.9.0-rc2/argocd-iac-install.html rename to docs/snyk/v2.9.0-rc3/argocd-iac-install.html index 3d521f9f74881..207acd982d50e 100644 --- a/docs/snyk/v2.9.0-rc2/argocd-iac-install.html +++ b/docs/snyk/v2.9.0-rc3/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:20:12 am (UTC+00:00)

    +

    October 29th 2023, 12:20:57 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.9.0-rc2/argocd-iac-namespace-install.html b/docs/snyk/v2.9.0-rc3/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.9.0-rc2/argocd-iac-namespace-install.html rename to docs/snyk/v2.9.0-rc3/argocd-iac-namespace-install.html index 8280d0891ebd1..9e4ae7e5224e8 100644 --- a/docs/snyk/v2.9.0-rc2/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.9.0-rc3/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:20:23 am (UTC+00:00)

    +

    October 29th 2023, 12:21:10 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.9.0-rc2/argocd-test.html b/docs/snyk/v2.9.0-rc3/argocd-test.html similarity index 99% rename from docs/snyk/v2.9.0-rc2/argocd-test.html rename to docs/snyk/v2.9.0-rc3/argocd-test.html index edf48da06d740..8a9efc79fd7df 100644 --- a/docs/snyk/v2.9.0-rc2/argocd-test.html +++ b/docs/snyk/v2.9.0-rc3/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:17:48 am (UTC+00:00)

    +

    October 29th 2023, 12:18:17 am (UTC+00:00)

    Scanned the following paths: @@ -811,12 +811,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

    @@ -648,12 +648,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.37.0 and openssl/libcrypto3@3.1.1-r1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.37.0 + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/snyk/v2.9.0-rc2/haproxy_2.6.14-alpine.html b/docs/snyk/v2.9.0-rc3/haproxy_2.6.14-alpine.html similarity index 53% rename from docs/snyk/v2.9.0-rc2/haproxy_2.6.14-alpine.html rename to docs/snyk/v2.9.0-rc3/haproxy_2.6.14-alpine.html index 87d2e9a0fef4b..d4837cba79b4d 100644 --- a/docs/snyk/v2.9.0-rc2/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.9.0-rc3/haproxy_2.6.14-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    October 22nd 2023, 12:18:01 am (UTC+00:00)

    +

    October 29th 2023, 12:18:32 am (UTC+00:00)

    Scanned the following path: @@ -466,8 +466,8 @@

    Snyk test report

    -
    0 known vulnerabilities
    -
    0 vulnerable dependency paths
    +
    1 known vulnerabilities
    +
    9 vulnerable dependency paths
    18 dependencies
    @@ -484,7 +484,198 @@

    Snyk test report

    - No known vulnerabilities detected. +
    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.2-r0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + › + openssl/libcrypto3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + .haproxy-rundeps@20230809.001942 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    • + Introduced through: + docker-image|haproxy@2.6.14-alpine + › + busybox/ssl_client@1.36.1-r2 + › + openssl/libssl3@3.1.2-r0 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    diff --git a/docs/snyk/v2.8.4/quay.io_argoproj_argocd_v2.8.4.html b/docs/snyk/v2.9.0-rc3/quay.io_argoproj_argocd_v2.9.0-rc3.html similarity index 68% rename from docs/snyk/v2.8.4/quay.io_argoproj_argocd_v2.8.4.html rename to docs/snyk/v2.9.0-rc3/quay.io_argoproj_argocd_v2.9.0-rc3.html index 41972f87bb6f3..c815a4833afb8 100644 --- a/docs/snyk/v2.8.4/quay.io_argoproj_argocd_v2.8.4.html +++ b/docs/snyk/v2.9.0-rc3/quay.io_argoproj_argocd_v2.9.0-rc3.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

    Snyk test report

    -

    October 22nd 2023, 12:21:18 am (UTC+00:00)

    +

    October 29th 2023, 12:18:58 am (UTC+00:00)

    Scanned the following paths:
      -
    • quay.io/argoproj/argocd:v2.8.4/argoproj/argocd (deb)
    • quay.io/argoproj/argocd:v2.8.4/argoproj/argo-cd/v2 (gomodules)
    • quay.io/argoproj/argocd:v2.8.4/kustomize/kustomize/v5 (gomodules)
    • quay.io/argoproj/argocd:v2.8.4/helm/v3 (gomodules)
    • quay.io/argoproj/argocd:v2.8.4/git-lfs/git-lfs (gomodules)
      • +
    • quay.io/argoproj/argocd:v2.9.0-rc3/argoproj/argocd (deb)
    • quay.io/argoproj/argocd:v2.9.0-rc3/argoproj/argo-cd/v2 (gomodules)
    • quay.io/argoproj/argocd:v2.9.0-rc3 (gomodules)
    • quay.io/argoproj/argocd:v2.9.0-rc3/helm/v3 (gomodules)
    • quay.io/argoproj/argocd:v2.9.0-rc3/git-lfs/git-lfs (gomodules)
    -
    39 known vulnerabilities
    -
    148 vulnerable dependency paths
    -
    2116 dependencies
    +
    30 known vulnerabilities
    +
    99 vulnerable dependency paths
    +
    2185 dependencies
    @@ -498,7 +498,7 @@

    Denial of Service (DoS)

  • Introduced through: - github.com/argoproj/argo-cd/v2@* and google.golang.org/grpc@v1.56.1 + github.com/argoproj/argo-cd/v2@* and google.golang.org/grpc@v1.56.2
    • @@ -513,7 +513,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@* › - google.golang.org/grpc@v1.56.1 + google.golang.org/grpc@v1.56.2 @@ -531,12 +531,15 @@

    Remediation

    Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.

    References

    @@ -587,7 +590,7 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@* › - golang.org/x/net/http2@v0.11.0 + golang.org/x/net/http2@v0.15.0 @@ -614,12 +617,15 @@

    Remediation

    Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.

    References

      +
    • Github Commit
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
      • +
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
    • GitHub Commit
      • +
    • GitHub Commit
    • Snyk Blog
    • Vulnerability Discovery
    • Vulnerability Explanation
      • @@ -632,104 +638,6 @@

      References

      More about this vulnerability

      - -
      -

      Out-of-bounds Write

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - glibc/libc-bin -
        • - -
      • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.8.4 and glibc/libc-bin@2.35-0ubuntu3.3 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - glibc/libc-bin@2.35-0ubuntu3.3 - - - -
        • -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - glibc/libc6@2.35-0ubuntu3.3 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

      -

      Remediation

      -

      Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.4 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      -

      Directory Traversal

      @@ -817,87 +725,6 @@

      References

      More about this vulnerability

      - -
      -

      Heap-based Buffer Overflow

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: ubuntu:22.04 -
        • -
      • - Vulnerable module: - - curl/libcurl3-gnutls -
        • - -
      • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.8.4, git@1:2.34.1-1ubuntu1.10 and others -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy - handshake.

      -

      When curl is asked to pass along the host name to the SOCKS5 proxy to allow - that to resolve the address instead of it getting done by curl itself, the - maximum length that host name can be is 255 bytes.

      -

      If the host name is detected to be longer, curl switches to local name - resolving and instead passes on the resolved address only. Due to this bug, - the local variable that means "let the host resolve the name" could get the - wrong value during a slow SOCKS5 handshake, and contrary to the intention, - copy the too long host name to the target buffer instead of copying just the - resolved address there.

      -

      The target buffer being a heap based buffer, and the host name coming from the - URL that curl has been told to operate with.

      -

      Remediation

      -

      Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.14 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      -

      CVE-2020-22916

      @@ -921,7 +748,7 @@

      CVE-2020-22916

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and xz-utils/liblzma5@5.2.5-2ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and xz-utils/liblzma5@5.2.5-2ubuntu1
    @@ -934,7 +761,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › xz-utils/liblzma5@5.2.5-2ubuntu1 @@ -995,7 +822,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4, git@1:2.34.1-1ubuntu1.10 and others + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3, git@1:2.34.1-1ubuntu1.10 and others
    @@ -1007,7 +834,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › @@ -1020,7 +847,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › @@ -1035,7 +862,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › @@ -1048,7 +875,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › @@ -1059,7 +886,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › perl/perl-base@5.34.0-3ubuntu1.2 @@ -1093,7 +920,7 @@

      References

      -

      Out-of-bounds Read

      +

      Access of Uninitialized Pointer

      @@ -1109,12 +936,12 @@

      Out-of-bounds Read

    • Vulnerable module: - libx11/libx11-data + krb5/libk5crypto3
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and libx11/libx11-data@2:1.7.5-1ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -1127,183 +954,159 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 + krb5/libk5crypto3@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + adduser@3.118ubuntu5 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + shadow/passwd@1:4.8.1-2ubuntu2.1 › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libk5crypto3@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - libxext/libxext6@2:1.3.4-1build1 + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 + › + krb5/libkrb5-3@1.19.2-2ubuntu0.2 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libk5crypto3@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - libxmu/libxmuu1@2:1.1.3-3 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libkrb5-3@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - xauth@1:1.1-1build2 + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 + › + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 + › + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libkrb5-3@1.19.2-2ubuntu0.2
      • -
    - - - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.

    -

    Remediation

    -

    Upgrade Ubuntu:22.04 libx11 to version 2:1.7.5-1ubuntu0.3 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - - -
    -

    Loop with Unreachable Exit Condition ('Infinite Loop')

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - libx11/libx11-data -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.8.4 and libx11/libx11-data@2:1.7.5-1ubuntu0.2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + openssh/openssh-client@1:8.9p1-3ubuntu0.4 › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + git@1:2.34.1-1ubuntu1.10 + › + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + git@1:2.34.1-1ubuntu1.10 + › + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › - libxext/libxext6@2:1.3.4-1build1 + libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + › + pam/libpam-modules@1.4.0-11ubuntu2.3 + › + libnsl/libnsl2@1.3.0-2build2 › - libxmu/libxmuu1@2:1.1.3-3 + libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - xauth@1:1.1-1build2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 + krb5/libkrb5support0@1.19.2-2ubuntu0.2 @@ -1315,369 +1118,31 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Ubuntu. +

      Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

      +

      lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

      Remediation

      -

      Upgrade Ubuntu:22.04 libx11 to version 2:1.7.5-1ubuntu0.3 or higher.

      +

      There is no fixed version for Ubuntu:22.04 krb5.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Integer Overflow or Wraparound

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - libx11/libx11-data -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.8.4 and libx11/libx11-data@2:1.7.5-1ubuntu0.2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - › - libx11/libx11-data@2:1.7.5-1ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libxext/libxext6@2:1.3.4-1build1 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libxmu/libxmuu1@2:1.1.3-3 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - xauth@1:1.1-1build2 - › - libx11/libx11-6@2:1.7.5-1ubuntu0.2 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.

    -

    Remediation

    -

    Upgrade Ubuntu:22.04 libx11 to version 2:1.7.5-1ubuntu0.3 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Access of Uninitialized Pointer

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - krb5/libk5crypto3 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.8.4 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - krb5/libk5crypto3@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libk5crypto3@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - krb5/libk5crypto3@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - krb5/libkrb5support0@1.19.2-2ubuntu0.2 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 krb5.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    LGPL-3.0 license

    +

    LGPL-3.0 license

    @@ -1755,7 +1220,7 @@

    Memory Leak

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and glibc/libc-bin@2.35-0ubuntu3.3 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and glibc/libc-bin@2.35-0ubuntu3.4
    • @@ -1768,18 +1233,18 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - glibc/libc-bin@2.35-0ubuntu3.3 + glibc/libc-bin@2.35-0ubuntu3.4
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - glibc/libc6@2.35-0ubuntu3.3 + glibc/libc6@2.35-0ubuntu3.4 @@ -2097,263 +1562,33 @@

      Detailed paths

      -

      More about this vulnerability

      -
      - -
    -
    -

    MPL-2.0 license

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: golang -
      • -
    • - Module: - - github.com/gosimple/slug -
      • - -
    • Introduced through: - - github.com/argoproj/argo-cd/v2@* and github.com/gosimple/slug@v1.13.1 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - github.com/argoproj/argo-cd/v2@* - › - github.com/gosimple/slug@v1.13.1 - - - -
      • -
    - -
    - -
    - -

    MPL-2.0 license

    - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    CVE-2022-46908

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - sqlite3/libsqlite3-0 -
      • - -
    • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.8.4, gnupg2/gpg@2.2.27-3ubuntu2.1 and others -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - gnupg2/gpg@2.2.27-3ubuntu2.1 - › - sqlite3/libsqlite3-0@3.37.2-2ubuntu0.1 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu:22.04. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 sqlite3.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Arbitrary Code Injection

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - shadow/passwd -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.8.4 and shadow/passwd@1:4.8.1-2ubuntu2.1 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - shadow/login@1:4.8.1-2ubuntu2.1 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu:22.04. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 shadow.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    +

    More about this vulnerability

    -
    -

    Out-of-bounds Write

    +
    +

    MPL-2.0 license

    -
    - low severity +
    + medium severity
    • - Package Manager: ubuntu:22.04 + Package Manager: golang
    • - Vulnerable module: + Module: - procps/libprocps8 + github.com/gosimple/slug
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and procps/libprocps8@2:3.3.17-6ubuntu2 + github.com/argoproj/argo-cd/v2@* and github.com/gosimple/slug@v1.13.1
    @@ -2366,29 +1601,9 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - procps/libprocps8@2:3.3.17-6ubuntu2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - procps@2:3.3.17-6ubuntu2 - › - procps/libprocps8@2:3.3.17-6ubuntu2 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + github.com/argoproj/argo-cd/v2@* › - procps@2:3.3.17-6ubuntu2 + github.com/gosimple/slug@v1.13.1 @@ -2399,28 +1614,17 @@

      Detailed paths

      -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream procps package and not the procps package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

      -

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 procps.

      -

      References

      - +

      MPL-2.0 license

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Uncontrolled Recursion

    +

    CVE-2022-46908

    @@ -2436,13 +1640,13 @@

    Uncontrolled Recursion

  • Vulnerable module: - pcre3/libpcre3 + sqlite3/libsqlite3-0
  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3, gnupg2/gpg@2.2.27-3ubuntu2.1 and others
    • @@ -2454,20 +1658,11 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - grep@3.7-1build1 + gnupg2/gpg@2.2.27-3ubuntu2.1 › - pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + sqlite3/libsqlite3-0@3.37.2-2ubuntu0.1 @@ -2479,32 +1674,29 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

      +

      SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 pcre3.

      +

      There is no fixed version for Ubuntu:22.04 sqlite3.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Release of Invalid Pointer or Reference

    +

    Arbitrary Code Injection

    @@ -2520,12 +1712,12 @@

    Release of Invalid Pointer or Reference

  • Vulnerable module: - patch + shadow/passwd
  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and shadow/passwd@1:4.8.1-2ubuntu2.1
    • @@ -2538,9 +1730,40 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - patch@2.7.6-7build2 + shadow/passwd@1:4.8.1-2ubuntu2.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + adduser@3.118ubuntu5 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + openssh/openssh-client@1:8.9p1-3ubuntu0.4 + › + shadow/passwd@1:4.8.1-2ubuntu2.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + shadow/login@1:4.8.1-2ubuntu2.1 @@ -2552,26 +1775,29 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

      +

      In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 patch.

      +

      There is no fixed version for Ubuntu:22.04 shadow.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Double Free

    +

    Out-of-bounds Write

    @@ -2587,12 +1813,12 @@

    Double Free

  • Vulnerable module: - patch + procps/libprocps8
  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and procps/libprocps8@2:3.3.17-6ubuntu2
    • @@ -2605,9 +1831,29 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - patch@2.7.6-7build2 + procps/libprocps8@2:3.3.17-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + procps@2:3.3.17-6ubuntu2 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 + › + procps@2:3.3.17-6ubuntu2 @@ -2619,31 +1865,27 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream procps package and not the procps package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

      +

      Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 patch.

      +

      There is no fixed version for Ubuntu:22.04 procps.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Improper Authentication

    +

    Uncontrolled Recursion

    @@ -2659,12 +1901,12 @@

    Improper Authentication

  • Vulnerable module: - openssl/libssl3 + pcre3/libpcre3
  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and openssl/libssl3@3.0.2-0ubuntu1.10 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    • @@ -2677,113 +1919,20 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - openssl@3.0.2-0ubuntu1.10 + pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - ca-certificates@20230311ubuntu0.22.04.1 + grep@3.7-1build1 › - openssl@3.0.2-0ubuntu1.10 + pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 @@ -2795,47 +1944,32 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu:22.04. +

      Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Issue summary: The AES-SIV cipher implementation contains a bug that causes - it to ignore empty associated data entries which are unauthenticated as - a consequence.

      -

      Impact summary: Applications that use the AES-SIV algorithm and want to - authenticate empty data entries as associated data can be mislead by removing - adding or reordering such empty entries as these are ignored by the OpenSSL - implementation. We are currently unaware of any such applications.

      -

      The AES-SIV algorithm allows for authentication of multiple associated - data entries along with the encryption. To authenticate empty data the - application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with - NULL pointer as the output buffer and 0 as the input buffer length. - The AES-SIV implementation in OpenSSL just returns success for such a call - instead of performing the associated data authentication operation. - The empty data thus will not be authenticated.

      -

      As this issue does not affect non-empty associated data authentication and - we expect it to be rare for an application to use empty associated data - entries this is qualified as Low severity issue.

      +

      In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      There is no fixed version for Ubuntu:22.04 pcre3.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Inefficient Regular Expression Complexity

    +

    Release of Invalid Pointer or Reference

    @@ -2851,12 +1985,12 @@

    Inefficient Regular Expression Complexity

  • Vulnerable module: - openssl/libssl3 + patch
  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and openssl/libssl3@3.0.2-0ubuntu1.10 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and patch@2.7.6-7build2
    • @@ -2869,113 +2003,9 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - ca-certificates@20230311ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - openssl@3.0.2-0ubuntu1.10 + patch@2.7.6-7build2 @@ -2987,57 +2017,26 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. +

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Issue summary: Checking excessively long DH keys or parameters may be very slow.

      -

      Impact summary: Applications that use the functions DH_check(), DH_check_ex() - or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long - delays. Where the key or parameters that are being checked have been obtained - from an untrusted source this may lead to a Denial of Service.

      -

      The function DH_check() performs various checks on DH parameters. One of those - checks confirms that the modulus ('p' parameter) is not too large. Trying to use - a very large modulus is slow and OpenSSL will not normally use a modulus which - is over 10,000 bits in length.

      -

      However the DH_check() function checks numerous aspects of the key or parameters - that have been supplied. Some of those checks use the supplied modulus value - even if it has already been found to be too large.

      -

      An application that calls DH_check() and supplies a key or parameters obtained - from an untrusted source could be vulernable to a Denial of Service attack.

      -

      The function DH_check() is itself called by a number of other OpenSSL functions. - An application calling any of those other functions may similarly be affected. - The other functions affected by this are DH_check_ex() and - EVP_PKEY_param_check().

      -

      Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications - when using the '-check' option.

      -

      The OpenSSL SSL/TLS implementation is not affected by this issue. - The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

      +

      An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      There is no fixed version for Ubuntu:22.04 patch.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Excessive Iteration

    +

    Double Free

    @@ -3053,12 +2052,12 @@

    Excessive Iteration

  • Vulnerable module: - openssl/libssl3 + patch
  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and openssl/libssl3@3.0.2-0ubuntu1.10 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and patch@2.7.6-7build2
    • @@ -3071,113 +2070,9 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - libfido2/libfido2-1@1.10.0-1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - › - libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - adduser@3.118ubuntu5 - › - shadow/passwd@1:4.8.1-2ubuntu2.1 - › - pam/libpam-modules@1.4.0-11ubuntu2.3 - › - libnsl/libnsl2@1.3.0-2build2 - › - libtirpc/libtirpc3@1.3.2-2ubuntu0.1 - › - krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 - › - krb5/libkrb5-3@1.19.2-2ubuntu0.2 - › - openssl/libssl3@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - openssl@3.0.2-0ubuntu1.10 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - ca-certificates@20230311ubuntu0.22.04.1 - › - openssl@3.0.2-0ubuntu1.10 + patch@2.7.6-7build2 @@ -3189,50 +2084,26 @@

      Detailed paths

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. +

      Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu:22.04. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      -

      Issue summary: Checking excessively long DH keys or parameters may be very slow.

      -

      Impact summary: Applications that use the functions DH_check(), DH_check_ex() - or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long - delays. Where the key or parameters that are being checked have been obtained - from an untrusted source this may lead to a Denial of Service.

      -

      The function DH_check() performs various checks on DH parameters. After fixing - CVE-2023-3446 it was discovered that a large q parameter value can also trigger - an overly long computation during some of these checks. A correct q value, - if present, cannot be larger than the modulus p parameter, thus it is - unnecessary to perform these checks if q is larger than p.

      -

      An application that calls DH_check() and supplies a key or parameters obtained - from an untrusted source could be vulnerable to a Denial of Service attack.

      -

      The function DH_check() is itself called by a number of other OpenSSL functions. - An application calling any of those other functions may similarly be affected. - The other functions affected by this are DH_check_ex() and - EVP_PKEY_param_check().

      -

      Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications - when using the "-check" option.

      -

      The OpenSSL SSL/TLS implementation is not affected by this issue.

      -

      The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

      +

      A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

      Remediation

      -

      There is no fixed version for Ubuntu:22.04 openssl.

      +

      There is no fixed version for Ubuntu:22.04 patch.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    @@ -3258,7 +2129,7 @@

    CVE-2023-28531

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and openssh/openssh-client@1:8.9p1-3ubuntu0.3 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and openssh/openssh-client@1:8.9p1-3ubuntu0.4
    • @@ -3271,9 +2142,9 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 + openssh/openssh-client@1:8.9p1-3ubuntu0.4 @@ -3328,7 +2199,7 @@

      NULL Pointer Dereference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others
    @@ -3340,7 +2211,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -3351,11 +2222,11 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › openldap/libldap-2.5-0@2.5.16+dfsg-0ubuntu0.22.04.1 @@ -3364,7 +2235,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › openldap/libldap-common@2.5.16+dfsg-0ubuntu0.22.04.1 @@ -3426,7 +2297,7 @@

      Resource Exhaustion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and libzstd/libzstd1@1.4.8+dfsg-3build1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and libzstd/libzstd1@1.4.8+dfsg-3build1
    @@ -3439,7 +2310,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › libzstd/libzstd1@1.4.8+dfsg-3build1 @@ -3497,7 +2368,7 @@

      Integer Overflow or Wraparound

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -3510,7 +2381,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › krb5/libk5crypto3@1.19.2-2ubuntu0.2 @@ -3519,7 +2390,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › adduser@3.118ubuntu5 › @@ -3540,7 +2411,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › adduser@3.118ubuntu5 › @@ -3563,7 +2434,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › krb5/libkrb5-3@1.19.2-2ubuntu0.2 @@ -3572,7 +2443,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › adduser@3.118ubuntu5 › @@ -3593,7 +2464,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -3602,9 +2473,9 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - openssh/openssh-client@1:8.9p1-3ubuntu0.3 + openssh/openssh-client@1:8.9p1-3ubuntu0.4 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -3613,11 +2484,11 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -3626,11 +2497,11 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 + curl/libcurl3-gnutls@7.81.0-1ubuntu1.14 › libssh/libssh-4@0.9.6-2ubuntu0.22.04.1 › @@ -3641,7 +2512,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › adduser@3.118ubuntu5 › @@ -3660,7 +2531,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › krb5/libkrb5support0@1.19.2-2ubuntu0.2 @@ -3717,7 +2588,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and gnupg2/gpgv@2.2.27-3ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and gnupg2/gpgv@2.2.27-3ubuntu2.1
    @@ -3730,7 +2601,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpgv@2.2.27-3ubuntu2.1 @@ -3739,7 +2610,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › apt@2.4.10 › @@ -3750,7 +2621,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3761,7 +2632,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -3772,7 +2643,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -3783,7 +2654,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3796,7 +2667,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3809,7 +2680,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 @@ -3818,7 +2689,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3829,7 +2700,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3842,7 +2713,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1 @@ -3851,7 +2722,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3862,7 +2733,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 @@ -3871,7 +2742,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3882,7 +2753,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpg@2.2.27-3ubuntu2.1 @@ -3891,7 +2762,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3902,7 +2773,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3915,7 +2786,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3928,7 +2799,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 @@ -3937,7 +2808,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3948,7 +2819,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3961,7 +2832,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3974,7 +2845,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 @@ -3983,7 +2854,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -3994,7 +2865,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 @@ -4003,7 +2874,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -4014,7 +2885,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 @@ -4023,7 +2894,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -4034,7 +2905,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gnupg2/gnupg@2.2.27-3ubuntu2.1 @@ -4093,7 +2964,7 @@

      Allocation of Resources Without Limits or Throttling

      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and glibc/libc-bin@2.35-0ubuntu3.3 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and glibc/libc-bin@2.35-0ubuntu3.4
    @@ -4106,18 +2977,18 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - glibc/libc-bin@2.35-0ubuntu3.3 + glibc/libc-bin@2.35-0ubuntu3.4
    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › - glibc/libc6@2.35-0ubuntu3.3 + glibc/libc6@2.35-0ubuntu3.4 @@ -4172,7 +3043,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4, git@1:2.34.1-1ubuntu1.10 and others + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3, git@1:2.34.1-1ubuntu1.10 and others
    @@ -4184,7 +3055,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 › @@ -4195,7 +3066,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git@1:2.34.1-1ubuntu1.10 @@ -4204,7 +3075,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › git-lfs@3.0.2-1ubuntu0.2 › @@ -4261,7 +3132,7 @@

      Uncontrolled Recursion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
    @@ -4274,7 +3145,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04 @@ -4283,7 +3154,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › apt@2.4.10 › @@ -4294,7 +3165,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › apt@2.4.10 › @@ -4307,7 +3178,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gcc-12/gcc-12-base@12.3.0-1ubuntu1~22.04 @@ -4316,7 +3187,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › gcc-12/libgcc-s1@12.3.0-1ubuntu1~22.04 @@ -4349,89 +3220,6 @@

      References

      More about this vulnerability

    -
    -
    -

    CVE-2023-38546

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - curl/libcurl3-gnutls -
      • - -
    • Introduced through: - - - docker-image|quay.io/argoproj/argocd@v2.8.4, git@1:2.34.1-1ubuntu1.10 and others -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 - › - git@1:2.34.1-1ubuntu1.10 - › - curl/libcurl3-gnutls@7.81.0-1ubuntu1.13 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    This flaw allows an attacker to insert cookies at will into a running program - using libcurl, if the specific series of conditions are met.

    -

    libcurl performs transfers. In its API, an application creates "easy handles" - that are the individual handles for single transfers.

    -

    libcurl provides a function call that duplicates en easy handle called - curl_easy_duphandle.

    -

    If a transfer has cookies enabled when the handle is duplicated, the - cookie-enable state is also cloned - but without cloning the actual - cookies. If the source handle did not read any cookies from a specific file on - disk, the cloned version of the handle would instead store the file name as - none (using the four ASCII letters, no quotes).

    -

    Subsequent use of the cloned handle that does not explicitly set a source to - load cookies from would then inadvertently load cookies from a file named - none - if such a file exists and is readable in the current directory of the - program using libcurl. And if using the correct file format of course.

    -

    Remediation

    -

    Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.14 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    -

    Improper Input Validation

    @@ -4455,7 +3243,7 @@

    Improper Input Validation

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and coreutils@8.32-4.1ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and coreutils@8.32-4.1ubuntu1
    • @@ -4468,7 +3256,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › coreutils@8.32-4.1ubuntu1 @@ -4525,7 +3313,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 and bash@5.1-6ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 and bash@5.1-6ubuntu1
    @@ -4538,7 +3326,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.4 + docker-image|quay.io/argoproj/argocd@v2.9.0-rc3 › bash@5.1-6ubuntu1 diff --git a/docs/snyk/v2.8.4/redis_7.0.11-alpine.html b/docs/snyk/v2.9.0-rc3/redis_7.0.11-alpine.html similarity index 81% rename from docs/snyk/v2.8.4/redis_7.0.11-alpine.html rename to docs/snyk/v2.9.0-rc3/redis_7.0.11-alpine.html index fe91f261fcc18..8efb859567ad3 100644 --- a/docs/snyk/v2.8.4/redis_7.0.11-alpine.html +++ b/docs/snyk/v2.9.0-rc3/redis_7.0.11-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

      Snyk test report

      -

      October 22nd 2023, 12:21:23 am (UTC+00:00)

      +

      October 29th 2023, 12:19:03 am (UTC+00:00)

      Scanned the following path: @@ -466,8 +466,8 @@

      Snyk test report

      -
      4 known vulnerabilities
      -
      32 vulnerable dependency paths
      +
      5 known vulnerabilities
      +
      41 vulnerable dependency paths
      18 dependencies
    @@ -1127,6 +1127,7 @@

    References

  • openssl-security@openssl.org
  • openssl-security@openssl.org
  • openssl-security@openssl.org
    • +
  • openssl-security@openssl.org
    • @@ -1136,6 +1137,196 @@

    References

    +
    +

    CVE-2023-5363

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.18 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + › + openssl/libcrypto3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + .redis-rundeps@20230614.215749 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + apk-tools/apk-tools@2.14.0-r2 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    • + Introduced through: + docker-image|redis@7.0.11-alpine + › + busybox/ssl_client@1.36.1-r0 + › + openssl/libssl3@3.1.1-r1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.18 relevant fixed versions and status.

    +

    Issue summary: A bug has been identified in the processing of key and + initialisation vector (IV) lengths. This can lead to potential truncation + or overruns during the initialisation of some symmetric ciphers.

    +

    Impact summary: A truncation in the IV can result in non-uniqueness, + which could result in loss of confidentiality for some cipher modes.

    +

    When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or + EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after + the key and IV have been established. Any alterations to the key length, + via the "keylen" parameter or the IV length, via the "ivlen" parameter, + within the OSSL_PARAM array will not take effect as intended, potentially + causing truncation or overreading of these values. The following ciphers + and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

    +

    For the CCM, GCM and OCB cipher modes, truncation of the IV can result in + loss of confidentiality. For example, when following NIST's SP 800-38D + section 8.2.1 guidance for constructing a deterministic IV for AES in + GCM mode, truncation of the counter portion could lead to IV reuse.

    +

    Both truncations and overruns of the key and overruns of the IV will + produce incorrect results and could, in some cases, trigger a memory + exception. However, these issues are not currently assessed as security + critical.

    +

    Changing the key and/or IV lengths is not considered to be a common operation + and the vulnerable API was recently introduced. Furthermore it is likely that + application developers will have spotted this problem during testing since + decryption would fail unless both peers in the communication were similarly + vulnerable. For these reasons we expect the probability of an application being + vulnerable to this to be quite low. However if an application is vulnerable then + this issue is considered very serious. For these reasons we have assessed this + issue as Moderate severity overall.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because + the issue lies outside of the FIPS provider boundary.

    +

    OpenSSL 3.1 and 3.0 are vulnerable to this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.18 openssl to version 3.1.4-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/user-guide/commands/argocd_admin_proj_generate-allow-list.md b/docs/user-guide/commands/argocd_admin_proj_generate-allow-list.md index a16d6468cb446..83dc00a6096b4 100644 --- a/docs/user-guide/commands/argocd_admin_proj_generate-allow-list.md +++ b/docs/user-guide/commands/argocd_admin_proj_generate-allow-list.md @@ -8,6 +8,13 @@ Generates project allow list from the specified clusterRole file argocd admin proj generate-allow-list CLUSTERROLE_PATH PROJ_NAME [flags] ``` +### Examples + +``` +# Generates project allow list from the specified clusterRole file +argocd admin proj generate-allow-list /path/to/clusterrole.yaml my-project +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_admin_settings_rbac_validate.md b/docs/user-guide/commands/argocd_admin_settings_rbac_validate.md index 75bc909882e19..b051c7c63694b 100644 --- a/docs/user-guide/commands/argocd_admin_settings_rbac_validate.md +++ b/docs/user-guide/commands/argocd_admin_settings_rbac_validate.md @@ -8,18 +8,57 @@ Validate RBAC policy Validates an RBAC policy for being syntactically correct. The policy must be -a local file, and in either CSV or K8s ConfigMap format. +a local file or a K8s ConfigMap in the provided namespace, and in either CSV or K8s ConfigMap format. ``` -argocd admin settings rbac validate --policy-file=POLICYFILE [flags] +argocd admin settings rbac validate [--policy-file POLICYFILE] [--namespace NAMESPACE] [flags] +``` + +### Examples + +``` + +# Check whether a given policy file is valid using a local policy.csv file. +argocd admin settings rbac validate --policy-file policy.csv + +# Policy file can also be K8s config map with data keys like argocd-rbac-cm, +# i.e. 'policy.csv' and (optionally) 'policy.default' +argocd admin settings rbac validate --policy-file argocd-rbac-cm.yaml + +# If --policy-file is not given, and instead --namespace is giventhe ConfigMap 'argocd-rbac-cm' +# from K8s is used. +argocd admin settings rbac validate --namespace argocd + +# Either --policy-file or --namespace must be given. + ``` ### Options ``` - -h, --help help for validate - --policy-file string path to the policy file to use + --as string Username to impersonate for the operation + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --disable-compression If true, opt-out of response compression for all requests to the server + -h, --help help for validate + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to a kube config. Only required if out-of-cluster + --namespace string namespace to get argo rbac configmap from + --password string Password for basic authentication to the API server + --policy-file string path to the policy file to use + --proxy-url string If provided, this URL will be used to connect via proxy + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + --server string The address and port of the Kubernetes API server + --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server ``` ### Options inherited from parent commands @@ -27,49 +66,29 @@ argocd admin settings rbac validate --policy-file=POLICYFILE [flags] ``` --argocd-cm-path string Path to local argocd-cm.yaml file --argocd-secret-path string Path to local argocd-secret.yaml file - --as string Username to impersonate for the operation - --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. - --as-uid string UID to impersonate for the operation --auth-token string Authentication token - --certificate-authority string Path to a cert file for the certificate authority - --client-certificate string Path to a client certificate file for TLS --client-crt string Client certificate file --client-crt-key string Client certificate key file - --client-key string Path to a client key file for TLS - --cluster string The name of the kubeconfig cluster to use --config string Path to Argo CD config (default "/home/user/.config/argocd/config") - --context string The name of the kubeconfig context to use --controller-name string Name of the Argo CD Application controller; set this or the ARGOCD_APPLICATION_CONTROLLER_NAME environment variable when the controller's name label differs from the default, for example when installing via the Helm chart (default "argocd-application-controller") --core If set to true then CLI talks directly to Kubernetes instead of talking to Argo CD API server - --disable-compression If true, opt-out of response compression for all requests to the server --grpc-web Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. --grpc-web-root-path string Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. Set web root. -H, --header strings Sets additional header to all requests made by Argo CD CLI. (Can be repeated multiple times to add multiple headers, also supports comma separated headers) --http-retry-max int Maximum number of retries to establish http connection to Argo CD server --insecure Skip server certificate and domain verification - --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kube-context string Directs the command to the given kube-context - --kubeconfig string Path to a kube config. Only required if out-of-cluster --load-cluster-settings Indicates that config map and secret should be loaded from cluster unless local file path is provided --logformat string Set the logging format. One of: text|json (default "text") --loglevel string Set the logging level. One of: debug|info|warn|error (default "info") - -n, --namespace string If present, the namespace scope for this CLI request - --password string Password for basic authentication to the API server --plaintext Disable TLS --port-forward Connect to a random argocd-server port using port forwarding --port-forward-namespace string Namespace name which should be used for port forwarding - --proxy-url string If provided, this URL will be used to connect via proxy --redis-haproxy-name string Name of the Redis HA Proxy; set this or the ARGOCD_REDIS_HAPROXY_NAME environment variable when the HA Proxy's name label differs from the default, for example when installing via the Helm chart (default "argocd-redis-ha-haproxy") --redis-name string Name of the Redis deployment; set this or the ARGOCD_REDIS_NAME environment variable when the Redis's name label differs from the default, for example when installing via the Helm chart (default "argocd-redis") --repo-server-name string Name of the Argo CD Repo server; set this or the ARGOCD_REPO_SERVER_NAME environment variable when the server's name label differs from the default, for example when installing via the Helm chart (default "argocd-repo-server") - --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") - --server string The address and port of the Kubernetes API server --server-crt string Server certificate file --server-name string Name of the Argo CD API server; set this or the ARGOCD_SERVER_NAME environment variable when the server's name label differs from the default, for example when installing via the Helm chart (default "argocd-server") - --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. - --token string Bearer token for authentication to the API server - --user string The name of the kubeconfig user to use - --username string Username for basic authentication to the API server ``` ### SEE ALSO diff --git a/docs/user-guide/commands/argocd_gpg_get.md b/docs/user-guide/commands/argocd_gpg_get.md index 0810b880cd8d2..e0ad3d9ee25d6 100644 --- a/docs/user-guide/commands/argocd_gpg_get.md +++ b/docs/user-guide/commands/argocd_gpg_get.md @@ -8,6 +8,19 @@ Get the GPG public key with ID from the server argocd gpg get KEYID [flags] ``` +### Examples + +``` + # Get a GPG public key with the specified KEYID in wide format (default). + argocd gpg get KEYID + + # Get a GPG public key with the specified KEYID in JSON format. + argocd gpg get KEYID -o json + + # Get a GPG public key with the specified KEYID in YAML format. + argocd gpg get KEYID -o yaml +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_gpg_list.md b/docs/user-guide/commands/argocd_gpg_list.md index 9e280cca30631..50f0e72e83c0d 100644 --- a/docs/user-guide/commands/argocd_gpg_list.md +++ b/docs/user-guide/commands/argocd_gpg_list.md @@ -8,6 +8,19 @@ List configured GPG public keys argocd gpg list [flags] ``` +### Examples + +``` + # List all configured GPG public keys in wide format (default). + argocd gpg list + + # List all configured GPG public keys in JSON format. + argocd gpg list -o json + + # List all configured GPG public keys in YAML format. + argocd gpg list -o yaml +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_add-policy.md b/docs/user-guide/commands/argocd_proj_role_add-policy.md index a19b51e405e95..d4804d31d66a1 100644 --- a/docs/user-guide/commands/argocd_proj_role_add-policy.md +++ b/docs/user-guide/commands/argocd_proj_role_add-policy.md @@ -8,6 +8,35 @@ Add a policy to a project role argocd proj role add-policy PROJECT ROLE-NAME [flags] ``` +### Examples + +``` +# Before adding new policy +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (3 hours ago) + +# Add a new policy to allow update to the project +$ argocd proj role add-policy test-project test-role -a update -p allow -o project + +# Policy should be updated +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +p, proj:test-project:test-role, applications, update, test-project/project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (3 hours ago) + +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_create-token.md b/docs/user-guide/commands/argocd_proj_role_create-token.md index 3d88481a9bc5e..fc7eaf93c2307 100644 --- a/docs/user-guide/commands/argocd_proj_role_create-token.md +++ b/docs/user-guide/commands/argocd_proj_role_create-token.md @@ -8,6 +8,18 @@ Create a project token argocd proj role create-token PROJECT ROLE-NAME [flags] ``` +### Examples + +``` +$ argocd proj role create-token test-project test-role +Create token succeeded for proj:test-project:test-role. + ID: f316c466-40bd-4cfd-8a8c-1392e92255d4 + Issued At: 2023-10-08T15:21:40+01:00 + Expires At: Never + Token: xxx + +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_create.md b/docs/user-guide/commands/argocd_proj_role_create.md index 6bfbd0c077232..60974c9e1b4e6 100644 --- a/docs/user-guide/commands/argocd_proj_role_create.md +++ b/docs/user-guide/commands/argocd_proj_role_create.md @@ -8,6 +8,13 @@ Create a project role argocd proj role create PROJECT ROLE-NAME [flags] ``` +### Examples + +``` + # Create a project role in the "my-project" project with the name "my-role". + argocd proj role create my-project my-role --description "My project role description" +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_delete-token.md b/docs/user-guide/commands/argocd_proj_role_delete-token.md index c4aa602628144..006746f8faeeb 100644 --- a/docs/user-guide/commands/argocd_proj_role_delete-token.md +++ b/docs/user-guide/commands/argocd_proj_role_delete-token.md @@ -8,6 +8,38 @@ Delete a project token argocd proj role delete-token PROJECT ROLE-NAME ISSUED-AT [flags] ``` +### Examples + +``` +#Create project test-project +$ argocd proj create test-project + +# Create a role associated with test-project +$ argocd proj role create test-project test-role +Role 'test-role' created + +# Create test-role associated with test-project +$ argocd proj role create-token test-project test-role +Create token succeeded for proj:test-project:test-role. + ID: c312450e-12e1-4e0d-9f65-fac9cb027b32 + Issued At: 2023-10-08T13:58:57+01:00 + Expires At: Never + Token: xxx + +# Get test-role id to input into the delete-token command below +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696769937 2023-10-08T13:58:57+01:00 (6 minutes ago) + +$ argocd proj role delete-token test-project test-role 1696769937 + +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_delete.md b/docs/user-guide/commands/argocd_proj_role_delete.md index 0d25facb22691..fe94a2231db60 100644 --- a/docs/user-guide/commands/argocd_proj_role_delete.md +++ b/docs/user-guide/commands/argocd_proj_role_delete.md @@ -11,8 +11,7 @@ argocd proj role delete PROJECT ROLE-NAME [flags] ### Examples ``` - # Delete a project role from the "my-project" project with the name "my-role". - argocd proj role delete my-project my-role +$ argocd proj role delete test-project test-role ``` ### Options diff --git a/docs/user-guide/commands/argocd_proj_role_get.md b/docs/user-guide/commands/argocd_proj_role_get.md index a469c4d695203..e21276ce85116 100644 --- a/docs/user-guide/commands/argocd_proj_role_get.md +++ b/docs/user-guide/commands/argocd_proj_role_get.md @@ -8,6 +8,21 @@ Get the details of a specific role argocd proj role get PROJECT ROLE-NAME [flags] ``` +### Examples + +``` +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696774900 2023-10-08T15:21:40+01:00 (4 minutes ago) +1696759698 2023-10-08T11:08:18+01:00 (4 hours ago) + +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_list-tokens.md b/docs/user-guide/commands/argocd_proj_role_list-tokens.md index 46e9e131f52bf..8d1fe93163dfc 100644 --- a/docs/user-guide/commands/argocd_proj_role_list-tokens.md +++ b/docs/user-guide/commands/argocd_proj_role_list-tokens.md @@ -8,6 +8,16 @@ List tokens for a given role. argocd proj role list-tokens PROJECT ROLE-NAME [flags] ``` +### Examples + +``` +$ argocd proj role list-tokens test-project test-role +ID ISSUED AT EXPIRES AT +f316c466-40bd-4cfd-8a8c-1392e92255d4 2023-10-08T15:21:40+01:00 Never +fa9d3517-c52d-434c-9bff-215b38508842 2023-10-08T11:08:18+01:00 Never + +``` + ### Options ``` diff --git a/docs/user-guide/commands/argocd_proj_role_remove-policy.md b/docs/user-guide/commands/argocd_proj_role_remove-policy.md index 3f77922eacb09..96aee05da86eb 100644 --- a/docs/user-guide/commands/argocd_proj_role_remove-policy.md +++ b/docs/user-guide/commands/argocd_proj_role_remove-policy.md @@ -8,6 +8,35 @@ Remove a policy from a role within a project argocd proj role remove-policy PROJECT ROLE-NAME [flags] ``` +### Examples + +``` +List the policy of the test-role before removing a policy +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +p, proj:test-project:test-role, applications, update, test-project/project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (3 hours ago) + +# Remove the policy to allow update to objects +$ argocd proj role remove-policy test-project test-role -a update -p allow -o project + +# The role should be removed now. +$ argocd proj role get test-project test-role +Role Name: test-role +Description: +Policies: +p, proj:test-project:test-role, projects, get, test-project, allow +JWT Tokens: +ID ISSUED-AT EXPIRES-AT +1696759698 2023-10-08T11:08:18+01:00 (4 hours ago) + +``` + ### Options ``` diff --git a/mkdocs.yml b/mkdocs.yml index 35b0b30c10345..61abeae5f8725 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -40,6 +40,7 @@ nav: - operator-manual/user-management/openunison.md - operator-manual/user-management/google.md - operator-manual/user-management/zitadel.md + - operator-manual/user-management/identity-center.md - operator-manual/rbac.md - Security: - Overview: operator-manual/security.md diff --git a/notification_controller/controller/controller.go b/notification_controller/controller/controller.go index a08c0cc1f9714..32dfac2b75a3b 100644 --- a/notification_controller/controller/controller.go +++ b/notification_controller/controller/controller.go @@ -12,6 +12,8 @@ import ( service "github.com/argoproj/argo-cd/v2/util/notification/argocd" + argocert "github.com/argoproj/argo-cd/v2/util/cert" + "k8s.io/apimachinery/pkg/runtime/schema" "github.com/argoproj/argo-cd/v2/util/notification/settings" @@ -21,6 +23,7 @@ import ( "github.com/argoproj/notifications-engine/pkg/controller" "github.com/argoproj/notifications-engine/pkg/services" "github.com/argoproj/notifications-engine/pkg/subscriptions" + httputil "github.com/argoproj/notifications-engine/pkg/util/http" log "github.com/sirupsen/logrus" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" @@ -160,6 +163,9 @@ type notificationController struct { } func (c *notificationController) Init(ctx context.Context) error { + // resolve certificates using injected "argocd-tls-certs-cm" ConfigMap + httputil.SetCertResolver(argocert.GetCertificateForConnect) + go c.appInformer.Run(ctx.Done()) go c.appProjInformer.Run(ctx.Done()) go c.secretInformer.Run(ctx.Done()) diff --git a/test/e2e/delarative_test.go b/test/e2e/declarative_test.go similarity index 100% rename from test/e2e/delarative_test.go rename to test/e2e/declarative_test.go