Advisories for CVE-2023-48795

Signed-off-by: Philippe Deslauriers <[email protected]>
sergio-chainguard · Dec 19, 2023 · 99ea79b · 99ea79b
1 parent 69f187f
commit 99ea79b
Show file tree

Hide file tree

Showing 15 changed files with 150 additions and 15 deletions.
diff --git a/apko.advisories.yaml b/apko.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: apko
@@ -87,6 +87,15 @@ advisories:
         data:
           fixed-version: 0.11.3-r0
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:56:36Z
+        type: fixed
+        data:
+          fixed-version: 0.12.0-r2
+
   - id: GHSA-jq35-85cj-fj4p
     events:
       - timestamp: 2023-10-31T20:03:39Z

diff --git a/argo-cd-2.7.advisories.yaml b/argo-cd-2.7.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: argo-cd-2.7
@@ -99,6 +99,15 @@ advisories:
         data:
           fixed-version: 2.7.15-r0
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T18:22:31Z
+        type: fixed
+        data:
+          fixed-version: 2.7.15-r6
+
   - id: CVE-2023-5528
     aliases:
       - GHSA-hq6q-c2x6-hmch

diff --git a/argo-cd-2.8.advisories.yaml b/argo-cd-2.8.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: argo-cd-2.8
@@ -89,6 +89,15 @@ advisories:
         data:
           fixed-version: 2.8.6-r2
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T18:22:00Z
+        type: fixed
+        data:
+          fixed-version: 2.8.7-r5
+
   - id: CVE-2023-5528
     aliases:
       - GHSA-hq6q-c2x6-hmch

diff --git a/argo-cd-2.9.advisories.yaml b/argo-cd-2.9.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: argo-cd-2.9
@@ -32,6 +32,15 @@ advisories:
         data:
           fixed-version: 2.9.2-r1
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T18:23:00Z
+        type: fixed
+        data:
+          fixed-version: 2.9.3-r4
+
   - id: CVE-2023-5528
     aliases:
       - GHSA-hq6q-c2x6-hmch

diff --git a/argo-workflows.advisories.yaml b/argo-workflows.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: argo-workflows
@@ -33,6 +33,15 @@ advisories:
         data:
           fixed-version: 3.5.2-r1
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:57:10Z
+        type: fixed
+        data:
+          fixed-version: 3.5.2-r3
+
   - id: GHSA-2c7c-3mj9-8fqh
     events:
       - timestamp: 2023-11-23T08:30:52Z

diff --git a/cadvisor.advisories.yaml b/cadvisor.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: "2"
+schema-version: 2.0.2
 
 package:
   name: cadvisor
@@ -22,6 +22,15 @@ advisories:
         data:
           type: vulnerable-code-version-not-used
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:57:24Z
+        type: fixed
+        data:
+          fixed-version: 0.48.1-r3
+
   - id: GHSA-6xv5-86q9-7xr8
     events:
       - timestamp: 2023-09-09T15:18:01Z

diff --git a/cert-manager-1.11.advisories.yaml b/cert-manager-1.11.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: cert-manager-1.11
@@ -62,6 +62,15 @@ advisories:
         data:
           fixed-version: 1.11.5-r6
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:57:47Z
+        type: fixed
+        data:
+          fixed-version: 1.11.5-r9
+
   - id: GHSA-jq35-85cj-fj4p
     events:
       - timestamp: 2023-11-17T11:21:22Z

diff --git a/cert-manager-1.12.advisories.yaml b/cert-manager-1.12.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: cert-manager-1.12
@@ -52,6 +52,15 @@ advisories:
         data:
           fixed-version: 1.12.6-r1
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:58:13Z
+        type: fixed
+        data:
+          fixed-version: 1.12.7-r2
+
   - id: GHSA-jq35-85cj-fj4p
     events:
       - timestamp: 2023-11-17T11:21:48Z

diff --git a/cert-manager-1.13.advisories.yaml b/cert-manager-1.13.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: cert-manager-1.13
@@ -52,6 +52,15 @@ advisories:
         data:
           fixed-version: 1.13.2-r1
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:58:38Z
+        type: fixed
+        data:
+          fixed-version: 1.13.3-r1
+
   - id: GHSA-2c7c-3mj9-8fqh
     events:
       - timestamp: 2023-11-23T08:31:08Z

diff --git a/flux-helm-controller.advisories.yaml b/flux-helm-controller.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: flux-helm-controller
@@ -62,6 +62,15 @@ advisories:
           type: vulnerable-code-not-included-in-package
           note: Only affects Windows
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:59:03Z
+        type: fixed
+        data:
+          fixed-version: 0.37.1-r1
+
   - id: GHSA-6xv5-86q9-7xr8
     events:
       - timestamp: 2023-09-09T15:18:03Z

diff --git a/flux-image-automation-controller.advisories.yaml b/flux-image-automation-controller.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: flux-image-automation-controller
@@ -42,6 +42,15 @@ advisories:
           type: vulnerable-code-not-included-in-package
           note: Only affects Windows
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:59:23Z
+        type: fixed
+        data:
+          fixed-version: 0.37.0-r2
+
   - id: GHSA-6xv5-86q9-7xr8
     events:
       - timestamp: 2023-09-09T15:18:06Z

diff --git a/flux-image-reflector-controller.advisories.yaml b/flux-image-reflector-controller.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: flux-image-reflector-controller
@@ -42,6 +42,15 @@ advisories:
           type: vulnerable-code-not-included-in-package
           note: Only affects Windows
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:59:41Z
+        type: fixed
+        data:
+          fixed-version: 0.31.1-r1
+
   - id: GHSA-jq35-85cj-fj4p
     events:
       - timestamp: 2023-10-31T20:03:46Z

diff --git a/flux-kustomize-controller.advisories.yaml b/flux-kustomize-controller.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: flux-kustomize-controller
@@ -52,6 +52,15 @@ advisories:
           type: vulnerable-code-not-included-in-package
           note: Only affects Windows
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T16:59:56Z
+        type: fixed
+        data:
+          fixed-version: 1.2.1-r1
+
   - id: GHSA-2c7c-3mj9-8fqh
     events:
       - timestamp: 2023-11-23T08:32:23Z

diff --git a/flux-source-controller.advisories.yaml b/flux-source-controller.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: flux-source-controller
@@ -61,6 +61,15 @@ advisories:
         data:
           note: Pending upstream fix, this will require more upgrades in the code to support the cosign update. GitHub Issue https://github.com/fluxcd/source-controller/pull/1280
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T17:00:24Z
+        type: fixed
+        data:
+          fixed-version: 1.2.3-r1
+
   - id: GHSA-2c7c-3mj9-8fqh
     events:
       - timestamp: 2023-11-23T08:32:38Z

diff --git a/flux.advisories.yaml b/flux.advisories.yaml
@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: flux
@@ -42,6 +42,15 @@ advisories:
           type: vulnerable-code-not-included-in-package
           note: Only affects Windows
 
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-19T17:00:35Z
+        type: fixed
+        data:
+          fixed-version: 2.2.1-r1
+
   - id: GHSA-jq35-85cj-fj4p
     events:
       - timestamp: 2023-10-31T20:03:44Z