From d2436d9f4d789565128e0fe439f8f1b3c30d83e7 Mon Sep 17 00:00:00 2001 From: Toni Grabulosa <71640433+toniGrabulosa@users.noreply.github.com> Date: Thu, 20 Jun 2024 17:25:09 +0200 Subject: [PATCH 01/23] Update USERS.md (#18743) Signed-off-by: Toni Grabulosa <71640433+toniGrabulosa@users.noreply.github.com> --- USERS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/USERS.md b/USERS.md index 609129ee498dd..ead03be9281a0 100644 --- a/USERS.md +++ b/USERS.md @@ -155,6 +155,7 @@ Currently, the following organizations are **officially** using Argo CD: 1. [Karrot](https://www.daangn.com/) 1. [KarrotPay](https://www.daangnpay.com/) 1. [Kasa](https://kasa.co.kr/) +1. [Kave Home](https://kavehome.com) 1. [Keeeb](https://www.keeeb.com/) 1. [KelkooGroup](https://www.kelkoogroup.com) 1. [Keptn](https://keptn.sh) From f7d854ec9ec1a1c3720a7584e8a7d440ddc08c6a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Jun 2024 09:23:16 -0400 Subject: [PATCH 02/23] chore(deps-dev): bump @types/node from 20.14.6 to 20.14.7 in /ui-test (#18750) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.14.6 to 20.14.7. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- ui-test/package.json | 2 +- ui-test/yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ui-test/package.json b/ui-test/package.json index 72b5d7cfa87b0..29a915c1c41b7 100644 --- a/ui-test/package.json +++ b/ui-test/package.json @@ -19,7 +19,7 @@ }, "devDependencies": { "@types/mocha": "^10.0.6", - "@types/node": "^20.14.6", + "@types/node": "^20.14.7", "dotenv": "^16.4.5", "mocha": "^10.4.0", "prettier": "^2.8.8", diff --git a/ui-test/yarn.lock b/ui-test/yarn.lock index 47d8ca9e41e0c..a4c86582f09c3 100644 --- a/ui-test/yarn.lock +++ b/ui-test/yarn.lock @@ -38,10 +38,10 @@ resolved "https://registry.yarnpkg.com/@types/mocha/-/mocha-10.0.6.tgz#818551d39113081048bdddbef96701b4e8bb9d1b" integrity sha512-dJvrYWxP/UcXm36Qn36fxhUKu8A/xMRXVT2cliFF1Z7UA9liG5Psj3ezNSZw+5puH2czDXRLcXQxf8JbJt0ejg== -"@types/node@*", "@types/node@^20.14.6": - version "20.14.6" - resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.6.tgz#f3c19ffc98c2220e18de259bb172dd4d892a6075" - integrity sha512-JbA0XIJPL1IiNnU7PFxDXyfAwcwVVrOoqyzzyQTyMeVhBzkJVMSkC1LlVsRQ2lpqiY4n6Bb9oCS6lzDKVQxbZw== +"@types/node@*", "@types/node@^20.14.7": + version "20.14.7" + resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.7.tgz#342cada27f97509eb8eb2dbc003edf21ce8ab5a8" + integrity sha512-uTr2m2IbJJucF3KUxgnGOZvYbN0QgkGyWxG6973HCpMYFy2KfcgYuIwkJQMQkt1VbBMlvWRbpshFTLxnxCZjKQ== dependencies: undici-types "~5.26.4" From e98d3b2a877fb7140880dc1450703a99db4398b5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Jun 2024 09:23:56 -0400 Subject: [PATCH 03/23] chore(deps): bump docker/build-push-action from 6.0.0 to 6.0.2 (#18749) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.0.0 to 6.0.2. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/c382f710d39a5bb4e430307530a720f50c2d3318...f6010ea70151369b06f0194be1051fbbdff851b2) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/image-reuse.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/image-reuse.yaml b/.github/workflows/image-reuse.yaml index 4cb2ca2614e80..7697d86dce33f 100644 --- a/.github/workflows/image-reuse.yaml +++ b/.github/workflows/image-reuse.yaml @@ -143,7 +143,7 @@ jobs: - name: Build and push container image id: image - uses: docker/build-push-action@c382f710d39a5bb4e430307530a720f50c2d3318 #v6.0.0 + uses: docker/build-push-action@f6010ea70151369b06f0194be1051fbbdff851b2 #v6.0.2 with: context: . platforms: ${{ inputs.platforms }} From cbb4c50018eba9a9d571d0adad3962684f65a726 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Jun 2024 14:13:44 -0400 Subject: [PATCH 04/23] chore(deps): bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#18727) Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.5 to 6.1.0. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/6d6857d36972b65feb161a90e484f2984215f83e...c5a7806660adbe173f04e3e038b0ccdcd758773c) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/init-release.yaml | 2 +- .github/workflows/release.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/init-release.yaml b/.github/workflows/init-release.yaml index 70de72d391dba..bc318d4f4b7dc 100644 --- a/.github/workflows/init-release.yaml +++ b/.github/workflows/init-release.yaml @@ -64,7 +64,7 @@ jobs: git stash pop - name: Create pull request - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5 + uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0 with: commit-message: "Bump version to ${{ inputs.TARGET_VERSION }}" title: "Bump version to ${{ inputs.TARGET_VERSION }} on ${{ inputs.TARGET_BRANCH }} branch" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b2a64d09aa9a6..97e65a20fddb7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -295,7 +295,7 @@ jobs: if: ${{ env.UPDATE_VERSION == 'true' }} - name: Create PR to update VERSION on master branch - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5 + uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0 with: commit-message: Bump version in master title: "chore: Bump version in master" From f655b0b2dffd882f9d9e14ba3208e64b42fcd961 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Jun 2024 14:14:12 -0400 Subject: [PATCH 05/23] chore(deps): bump softprops/action-gh-release from 2.0.5 to 2.0.6 (#18736) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.0.5 to 2.0.6. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/69320dbe05506a9a39fc8ae11030b214ec2d1f87...a74c6b72af54cfa997e81df42d94703d6313a2d0) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 97e65a20fddb7..e87f0b286cdbf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -197,7 +197,7 @@ jobs: echo "hashes=$(sha256sum /tmp/sbom.tar.gz | base64 -w0)" >> "$GITHUB_OUTPUT" - name: Upload SBOM - uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2.0.5 + uses: softprops/action-gh-release@a74c6b72af54cfa997e81df42d94703d6313a2d0 # v2.0.6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: From 1e916d9bb97d11973115f9cf3affaddbda608bad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Jun 2024 14:15:15 -0400 Subject: [PATCH 06/23] chore(deps): bump tj-actions/changed-files from 44.5.2 to 44.5.3 (#18737) Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 44.5.2 to 44.5.3. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](https://github.com/tj-actions/changed-files/compare/d6babd6899969df1a11d14c368283ea4436bca78...eaf854ef0c266753e1abec356dcf17d92695b251) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-build.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml index 51de323f3b76c..4dd652a4745bc 100644 --- a/.github/workflows/ci-build.yaml +++ b/.github/workflows/ci-build.yaml @@ -31,7 +31,7 @@ jobs: docs: ${{ steps.filter.outputs.docs_any_changed }} steps: - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0 - - uses: tj-actions/changed-files@d6babd6899969df1a11d14c368283ea4436bca78 # v44.5.2 + - uses: tj-actions/changed-files@eaf854ef0c266753e1abec356dcf17d92695b251 # v44.5.3 id: filter with: # Any file which is not under docs/, ui/ or is not a markdown file is counted as a backend file From 3dcddee199945a035a7ec15e24dee48944b09799 Mon Sep 17 00:00:00 2001 From: Matthieu MOREL Date: Fri, 21 Jun 2024 20:16:32 +0200 Subject: [PATCH 07/23] chore: enable float-compare rule from testifylint (#18721) * chore: enable float-compare rule from testifylint Signed-off-by: Matthieu MOREL * Update managed_fields_test.go Signed-off-by: Matthieu MOREL * Update managed_fields_test.go Signed-off-by: Matthieu MOREL --------- Signed-off-by: Matthieu MOREL --- .golangci.yaml | 1 - controller/appcontroller_test.go | 2 +- util/argo/diff/diff_test.go | 4 ++-- util/argo/managedfields/managed_fields_test.go | 8 +++++--- util/cache/redis_test.go | 4 ++-- util/env/env_test.go | 2 +- 6 files changed, 11 insertions(+), 10 deletions(-) diff --git a/.golangci.yaml b/.golangci.yaml index 589e1fa376af7..2351f11e0fecc 100644 --- a/.golangci.yaml +++ b/.golangci.yaml @@ -36,7 +36,6 @@ linters-settings: testifylint: enable-all: true disable: - - float-compare - go-require run: timeout: 50m diff --git a/controller/appcontroller_test.go b/controller/appcontroller_test.go index 389466908e71d..b0c536295203e 100644 --- a/controller/appcontroller_test.go +++ b/controller/appcontroller_test.go @@ -1645,7 +1645,7 @@ func TestProcessRequestedAppOperation_FailedHasRetries(t *testing.T) { message, _, _ := unstructured.NestedString(receivedPatch, "status", "operationState", "message") assert.Contains(t, message, "Retrying attempt #1") retryCount, _, _ := unstructured.NestedFloat64(receivedPatch, "status", "operationState", "retryCount") - assert.Equal(t, float64(1), retryCount) + assert.InEpsilon(t, float64(1), retryCount, 0.0001) } func TestProcessRequestedAppOperation_RunningPreviouslyFailed(t *testing.T) { diff --git a/util/argo/diff/diff_test.go b/util/argo/diff/diff_test.go index 6051701dad749..8912d9bf883b7 100644 --- a/util/argo/diff/diff_test.go +++ b/util/argo/diff/diff_test.go @@ -147,12 +147,12 @@ func TestStateDiff(t *testing.T) { replicas, found, err := unstructured.NestedFloat64(normalized.Object, "spec", "replicas") require.NoError(t, err) assert.True(t, found) - assert.Equal(t, float64(tc.expectedNormalizedReplicas), replicas) + assert.InEpsilon(t, float64(tc.expectedNormalizedReplicas), replicas, 0.0001) predicted := testutil.YamlToUnstructured(string(result.PredictedLive)) predictedReplicas, found, err := unstructured.NestedFloat64(predicted.Object, "spec", "replicas") require.NoError(t, err) assert.True(t, found) - assert.Equal(t, float64(tc.expectedPredictedReplicas), predictedReplicas) + assert.InEpsilon(t, float64(tc.expectedPredictedReplicas), predictedReplicas, 0.0001) }) } } diff --git a/util/argo/managedfields/managed_fields_test.go b/util/argo/managedfields/managed_fields_test.go index e94f486a64b29..0322485a778a1 100644 --- a/util/argo/managedfields/managed_fields_test.go +++ b/util/argo/managedfields/managed_fields_test.go @@ -38,14 +38,16 @@ func TestNormalize(t *testing.T) { liveReplicas, ok, err := unstructured.NestedFloat64(liveResult.Object, "spec", "replicas") assert.False(t, ok) require.NoError(t, err) - assert.Equal(t, liveReplicas, desiredReplicas) + assert.Zero(t, desiredReplicas) + assert.Zero(t, liveReplicas) liveRevisionHistory, ok, err := unstructured.NestedFloat64(liveResult.Object, "spec", "revisionHistoryLimit") assert.False(t, ok) require.NoError(t, err) desiredRevisionHistory, ok, err := unstructured.NestedFloat64(desiredResult.Object, "spec", "revisionHistoryLimit") assert.False(t, ok) require.NoError(t, err) - assert.Equal(t, liveRevisionHistory, desiredRevisionHistory) + assert.Zero(t, desiredRevisionHistory) + assert.Zero(t, liveRevisionHistory) }) t.Run("will keep conflicting fields if not from trusted manager", func(t *testing.T) { // given @@ -146,7 +148,7 @@ func TestNormalize(t *testing.T) { func validateNestedFloat64(t *testing.T, expected float64, obj *unstructured.Unstructured, fields ...string) { t.Helper() current := getNestedFloat64(t, obj, fields...) - assert.Equal(t, expected, current) + assert.InEpsilon(t, expected, current, 0.0001) } func getNestedFloat64(t *testing.T, obj *unstructured.Unstructured, fields ...string) float64 { diff --git a/util/cache/redis_test.go b/util/cache/redis_test.go index baf40c88811f8..6bc662a3e3cbf 100644 --- a/util/cache/redis_test.go +++ b/util/cache/redis_test.go @@ -145,7 +145,7 @@ func TestRedisMetrics(t *testing.T) { require.NoError(t, err) err = c.Write(metric) require.NoError(t, err) - assert.Equal(t, float64(2), metric.Counter.GetValue()) + assert.InEpsilon(t, float64(2), metric.Counter.GetValue(), 0.0001) // faulty client failed request err = faultyClient.Get("foo", &res) @@ -154,7 +154,7 @@ func TestRedisMetrics(t *testing.T) { require.NoError(t, err) err = c.Write(metric) require.NoError(t, err) - assert.Equal(t, float64(1), metric.Counter.GetValue()) + assert.InEpsilon(t, float64(1), metric.Counter.GetValue(), 0.0001) // both clients histogram count o, err := ms.redisRequestHistogram.GetMetricWithLabelValues("mock") diff --git a/util/env/env_test.go b/util/env/env_test.go index cb330becba0d0..84e87052c9e33 100644 --- a/util/env/env_test.go +++ b/util/env/env_test.go @@ -64,7 +64,7 @@ func TestParseFloatFromEnv(t *testing.T) { t.Run(tt.name, func(t *testing.T) { t.Setenv(envKey, tt.env) f := ParseFloatFromEnv(envKey, def, min, max) - assert.Equal(t, tt.expected, f) + assert.InEpsilon(t, tt.expected, f, 0.0001) }) } } From a624c9084582f4662a9c6919cdf055000b09fad0 Mon Sep 17 00:00:00 2001 From: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Date: Sun, 23 Jun 2024 21:08:17 -0400 Subject: [PATCH 08/23] fix(server): could not find source for metadata revision (#18744) (#18763) * fix(server): could not find source for metadata revision (#18744) Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * lint Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * the linter behaves poorly Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * fix test Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * share logic with chart endpoint Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * more intuitive check Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * remove debug line Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --------- Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --- server/application/application.go | 157 +++++------ server/application/application_test.go | 264 ++++++++++++++++++ .../application-deployment-history.tsx | 4 +- .../application-details.tsx | 13 +- ui/src/app/applications/components/utils.tsx | 6 +- .../shared/services/applications-service.ts | 30 +- 6 files changed, 373 insertions(+), 101 deletions(-) diff --git a/server/application/application.go b/server/application/application.go index b919bcdd66ac7..af535ca6295c8 100644 --- a/server/application/application.go +++ b/server/application/application.go @@ -1495,71 +1495,9 @@ func (s *Server) RevisionMetadata(ctx context.Context, q *application.RevisionMe return nil, err } - var versionId int64 = 0 - if q.VersionId != nil { - versionId = int64(*q.VersionId) - } - - var source *v1alpha1.ApplicationSource - - // To support changes between single source and multi source revisions - // we have to calculate if the operation has to be done as multisource or not. - // There are 2 different scenarios, checking current revision and historic revision - // - Current revision (VersionId is nil or 0): - // - The application is multi source and required version too -> multi source - // - The application is single source and the required version too -> single source - // - The application is multi source and the required version is single source -> single source - // - The application is single source and the required version is multi source -> multi source - // - Historic revision: - // - The application is multi source and the previous one too -> multi source - // - The application is single source and the previous one too -> single source - // - The application is multi source and the previous one is single source -> multi source - // - The application is single source and the previous one is multi source -> single source - isRevisionMultiSource := a.Spec.HasMultipleSources() - emptyHistory := len(a.Status.History) == 0 - if !emptyHistory { - for _, h := range a.Status.History { - if h.ID == versionId { - isRevisionMultiSource = len(h.Revisions) > 0 - break - } - } - } - - // If the historical data is empty (because the app hasn't been synced yet) - // we can use the source, if not (the app has been synced at least once) - // we have to use the history because sources can be added/removed - if emptyHistory { - if isRevisionMultiSource { - source = &a.Spec.Sources[*q.SourceIndex] - } else { - s := a.Spec.GetSource() - source = &s - } - } else { - // the source count can change during the time, we cannot just trust in .status.sync - // because if a source has been added/removed, the revisions there won't match - // as this is only used for the UI and not internally, we can use the historical data - // using the specific revisionId - for _, h := range a.Status.History { - if h.ID == versionId { - // The iteration values are assigned to the respective iteration variables as in an assignment statement. - // The iteration variables may be declared by the “range” clause using a form of short variable declaration (:=). - // In this case their types are set to the types of the respective iteration values and their scope is the block of the "for" statement; - // they are re-used in each iteration. If the iteration variables are declared outside the "for" statement, - // after execution their values will be those of the last iteration. - // https://golang.org/ref/spec#For_statements - h := h - if isRevisionMultiSource { - source = &h.Sources[*q.SourceIndex] - } else { - source = &h.Source - } - } - } - } - if source == nil { - return nil, fmt.Errorf("revision not found: %w", err) + source, err := getAppSourceBySourceIndexAndVersionId(a, q.SourceIndex, q.VersionId) + if err != nil { + return nil, fmt.Errorf("error getting app source by source index and version ID: %w", err) } repo, err := s.db.GetRepository(ctx, source.RepoURL, proj.Name) @@ -1585,22 +1523,9 @@ func (s *Server) RevisionChartDetails(ctx context.Context, q *application.Revisi return nil, err } - var source *v1alpha1.ApplicationSource - if a.Spec.HasMultipleSources() { - // the source count can change during the time, we cannot just trust in .status.sync - // because if a source has been added/removed, the revisions there won't match - // as this is only used for the UI and not internally, we can use the historical data - // using the specific revisionId - for _, h := range a.Status.History { - if h.ID == int64(*q.VersionId) { - source = &h.Sources[*q.SourceIndex] - } - } - if source == nil { - return nil, fmt.Errorf("revision not found: %w", err) - } - } else { - source = a.Spec.Source + source, err := getAppSourceBySourceIndexAndVersionId(a, q.SourceIndex, q.VersionId) + if err != nil { + return nil, fmt.Errorf("error getting app source by source index and version ID: %w", err) } if source.Chart == "" { @@ -1622,6 +1547,76 @@ func (s *Server) RevisionChartDetails(ctx context.Context, q *application.Revisi }) } +// getAppSourceBySourceIndexAndVersionId returns the source for a specific source index and version ID. Source index and +// version ID are optional. If the source index is not specified, it defaults to 0. If the version ID is not specified, +// we use the source(s) currently configured for the app. If the version ID is specified, we find the source for that +// version ID. If the version ID is not found, we return an error. If the source index is out of bounds for whichever +// source we choose (configured sources or sources for a specific version), we return an error. +func getAppSourceBySourceIndexAndVersionId(a *appv1.Application, sourceIndexMaybe *int32, versionIdMaybe *int32) (appv1.ApplicationSource, error) { + // Start with all the app's configured sources. + sources := a.Spec.GetSources() + + // If the user specified a version, get the sources for that version. If the version is not found, return an error. + if versionIdMaybe != nil { + versionId := int64(*versionIdMaybe) + var err error + sources, err = getSourcesByVersionId(a, versionId) + if err != nil { + return appv1.ApplicationSource{}, fmt.Errorf("error getting source by version ID: %w", err) + } + } + + // Start by assuming we want the first source. + sourceIndex := 0 + + // If the user specified a source index, use that instead. + if sourceIndexMaybe != nil { + sourceIndex = int(*sourceIndexMaybe) + if sourceIndex >= len(sources) { + if len(sources) == 1 { + return appv1.ApplicationSource{}, fmt.Errorf("source index %d not found because there is only 1 source", sourceIndex) + } + return appv1.ApplicationSource{}, fmt.Errorf("source index %d not found because there are only %d sources", sourceIndex, len(sources)) + } + } + + source := sources[sourceIndex] + + return source, nil +} + +// getRevisionHistoryByVersionId returns the revision history for a specific version ID. +// If the version ID is not found, it returns an empty revision history and false. +func getRevisionHistoryByVersionId(histories v1alpha1.RevisionHistories, versionId int64) (appv1.RevisionHistory, bool) { + for _, h := range histories { + if h.ID == versionId { + return h, true + } + } + return appv1.RevisionHistory{}, false +} + +// getSourcesByVersionId returns the sources for a specific version ID. If there is no history, it returns an error. +// If the version ID is not found, it returns an error. If the version ID is found, and there are multiple sources, +// it returns the sources for that version ID. If the version ID is found, and there is only one source, it returns +// a slice with just the single source. +func getSourcesByVersionId(a *appv1.Application, versionId int64) ([]appv1.ApplicationSource, error) { + if len(a.Status.History) == 0 { + return nil, fmt.Errorf("version ID %d not found because the app has no history", versionId) + } + + h, ok := getRevisionHistoryByVersionId(a.Status.History, versionId) + if !ok { + return nil, fmt.Errorf("revision history not found for version ID %d", versionId) + } + + if len(h.Sources) > 0 { + return h.Sources, nil + } + + return []v1alpha1.ApplicationSource{h.Source}, nil +} + func isMatchingResource(q *application.ResourcesQuery, key kube.ResourceKey) bool { return (q.GetName() == "" || q.GetName() == key.Name) && (q.GetNamespace() == "" || q.GetNamespace() == key.Namespace) && diff --git a/server/application/application_test.go b/server/application/application_test.go index ca81e7a6151a2..96bfeaf51221c 100644 --- a/server/application/application_test.go +++ b/server/application/application_test.go @@ -10,6 +10,8 @@ import ( "testing" "time" + "k8s.io/utils/pointer" + "k8s.io/apimachinery/pkg/labels" "github.com/argoproj/gitops-engine/pkg/health" @@ -3025,3 +3027,265 @@ func TestServer_ResolveSourceRevisions_SingleSource(t *testing.T) { assert.Equal(t, ([]string)(nil), sourceRevisions) assert.Equal(t, ([]string)(nil), displayRevisions) } + +func Test_RevisionMetadata(t *testing.T) { + singleSourceApp := newTestApp() + singleSourceApp.Name = "single-source-app" + singleSourceApp.Spec = appv1.ApplicationSpec{ + Source: &appv1.ApplicationSource{ + RepoURL: "https://github.com/argoproj/argocd-example-apps.git", + Path: "helm-guestbook", + TargetRevision: "HEAD", + }, + } + + multiSourceApp := newTestApp() + multiSourceApp.Name = "multi-source-app" + multiSourceApp.Spec = appv1.ApplicationSpec{ + Sources: []appv1.ApplicationSource{ + { + RepoURL: "https://github.com/argoproj/argocd-example-apps.git", + Path: "helm-guestbook", + TargetRevision: "HEAD", + }, + { + RepoURL: "https://github.com/argoproj/argocd-example-apps.git", + Path: "kustomize-guestbook", + TargetRevision: "HEAD", + }, + }, + } + + singleSourceHistory := []appv1.RevisionHistory{ + { + ID: 1, + Source: singleSourceApp.Spec.GetSource(), + Revision: "a", + }, + } + multiSourceHistory := []appv1.RevisionHistory{ + { + ID: 1, + Sources: multiSourceApp.Spec.GetSources(), + Revisions: []string{"a", "b"}, + }, + } + + testCases := []struct { + name string + multiSource bool + history *struct { + matchesSourceType bool + } + sourceIndex *int32 + versionId *int32 + expectErrorContains *string + }{ + { + name: "single-source app without history, no source index, no version ID", + multiSource: false, + }, + { + name: "single-source app without history, no source index, missing version ID", + multiSource: false, + versionId: pointer.Int32(999), + expectErrorContains: pointer.String("the app has no history"), + }, + { + name: "single source app without history, present source index, no version ID", + multiSource: false, + sourceIndex: pointer.Int32(0), + }, + { + name: "single source app without history, invalid source index, no version ID", + multiSource: false, + sourceIndex: pointer.Int32(999), + expectErrorContains: pointer.String("source index 999 not found"), + }, + { + name: "single source app with matching history, no source index, no version ID", + multiSource: false, + history: &struct{ matchesSourceType bool }{true}, + }, + { + name: "single source app with matching history, no source index, missing version ID", + multiSource: false, + history: &struct{ matchesSourceType bool }{true}, + versionId: pointer.Int32(999), + expectErrorContains: pointer.String("history not found for version ID 999"), + }, + { + name: "single source app with matching history, no source index, present version ID", + multiSource: false, + history: &struct{ matchesSourceType bool }{true}, + versionId: pointer.Int32(1), + }, + { + name: "single source app with multi-source history, no source index, no version ID", + multiSource: false, + history: &struct{ matchesSourceType bool }{false}, + }, + { + name: "single source app with multi-source history, no source index, missing version ID", + multiSource: false, + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(999), + expectErrorContains: pointer.String("history not found for version ID 999"), + }, + { + name: "single source app with multi-source history, no source index, present version ID", + multiSource: false, + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(1), + }, + { + name: "single-source app with multi-source history, source index 1, no version ID", + multiSource: false, + sourceIndex: pointer.Int32(1), + history: &struct{ matchesSourceType bool }{false}, + // Since the user requested source index 1, but no version ID, we'll get an error when looking at the live + // source, because the live source is single-source. + expectErrorContains: pointer.String("there is only 1 source"), + }, + { + name: "single-source app with multi-source history, invalid source index, no version ID", + multiSource: false, + sourceIndex: pointer.Int32(999), + history: &struct{ matchesSourceType bool }{false}, + expectErrorContains: pointer.String("source index 999 not found"), + }, + { + name: "single-source app with multi-source history, valid source index, present version ID", + multiSource: false, + sourceIndex: pointer.Int32(1), + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(1), + }, + { + name: "multi-source app without history, no source index, no version ID", + multiSource: true, + }, + { + name: "multi-source app without history, no source index, missing version ID", + multiSource: true, + versionId: pointer.Int32(999), + expectErrorContains: pointer.String("the app has no history"), + }, + { + name: "multi-source app without history, present source index, no version ID", + multiSource: true, + sourceIndex: pointer.Int32(1), + }, + { + name: "multi-source app without history, invalid source index, no version ID", + multiSource: true, + sourceIndex: pointer.Int32(999), + expectErrorContains: pointer.String("source index 999 not found"), + }, + { + name: "multi-source app with matching history, no source index, no version ID", + multiSource: true, + history: &struct{ matchesSourceType bool }{true}, + }, + { + name: "multi-source app with matching history, no source index, missing version ID", + multiSource: true, + history: &struct{ matchesSourceType bool }{true}, + versionId: pointer.Int32(999), + expectErrorContains: pointer.String("history not found for version ID 999"), + }, + { + name: "multi-source app with matching history, no source index, present version ID", + multiSource: true, + history: &struct{ matchesSourceType bool }{true}, + versionId: pointer.Int32(1), + }, + { + name: "multi-source app with single-source history, no source index, no version ID", + multiSource: true, + history: &struct{ matchesSourceType bool }{false}, + }, + { + name: "multi-source app with single-source history, no source index, missing version ID", + multiSource: true, + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(999), + expectErrorContains: pointer.String("history not found for version ID 999"), + }, + { + name: "multi-source app with single-source history, no source index, present version ID", + multiSource: true, + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(1), + }, + { + name: "multi-source app with single-source history, source index 1, no version ID", + multiSource: true, + sourceIndex: pointer.Int32(1), + history: &struct{ matchesSourceType bool }{false}, + }, + { + name: "multi-source app with single-source history, invalid source index, no version ID", + multiSource: true, + sourceIndex: pointer.Int32(999), + history: &struct{ matchesSourceType bool }{false}, + expectErrorContains: pointer.String("source index 999 not found"), + }, + { + name: "multi-source app with single-source history, valid source index, present version ID", + multiSource: true, + sourceIndex: pointer.Int32(0), + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(1), + }, + { + name: "multi-source app with single-source history, source index 1, present version ID", + multiSource: true, + sourceIndex: pointer.Int32(1), + history: &struct{ matchesSourceType bool }{false}, + versionId: pointer.Int32(1), + expectErrorContains: pointer.String("source index 1 not found"), + }, + } + + for _, tc := range testCases { + tcc := tc + t.Run(tcc.name, func(t *testing.T) { + app := singleSourceApp + if tcc.multiSource { + app = multiSourceApp + } + if tcc.history != nil { + if tcc.history.matchesSourceType { + if tcc.multiSource { + app.Status.History = multiSourceHistory + } else { + app.Status.History = singleSourceHistory + } + } else { + if tcc.multiSource { + app.Status.History = singleSourceHistory + } else { + app.Status.History = multiSourceHistory + } + } + } + + s := newTestAppServer(t, app) + + request := &application.RevisionMetadataQuery{ + Name: pointer.String(app.Name), + Revision: pointer.String("HEAD"), + SourceIndex: tcc.sourceIndex, + VersionId: tcc.versionId, + } + + _, err := s.RevisionMetadata(context.Background(), request) + if tcc.expectErrorContains != nil { + require.ErrorContains(t, err, *tcc.expectErrorContains) + } else { + require.NoError(t, err) + } + }) + } +} diff --git a/ui/src/app/applications/components/application-deployment-history/application-deployment-history.tsx b/ui/src/app/applications/components/application-deployment-history/application-deployment-history.tsx index 2e4514821d0d0..c81f2c41c55a0 100644 --- a/ui/src/app/applications/components/application-deployment-history/application-deployment-history.tsx +++ b/ui/src/app/applications/components/application-deployment-history/application-deployment-history.tsx @@ -153,7 +153,9 @@ export const ApplicationDeploymentHistory = ({ )) ) - ) : null} + ) : ( +

Click to see source details.

+ )} ))} diff --git a/ui/src/app/applications/components/application-details/application-details.tsx b/ui/src/app/applications/components/application-details/application-details.tsx index 53e9a9d77914f..34d5121f87557 100644 --- a/ui/src/app/applications/components/application-details/application-details.tsx +++ b/ui/src/app/applications/components/application-details/application-details.tsx @@ -192,7 +192,14 @@ export class ApplicationDetails extends React.Component { + const getContentForChart = ( + aRevision: string, + aSourceIndex: number | null, + aVersionId: number | null, + indx: number, + aSource: models.ApplicationSource, + sourceHeader?: JSX.Element + ) => { const showChartNonMetadataInfo = (aRevision: string, aRepoUrl: string) => { return ( <> @@ -366,9 +373,9 @@ export class ApplicationDetails extends React.Component{cont}; } else if (application.spec.source) { if (source.chart) { - cont.push(getContentForChart(revision, 0, 0, 0, source)); + cont.push(getContentForChart(revision, null, null, 0, source)); } else { - cont.push(getContentForNonChart(revision, 0, getAppCurrentVersion(application), 0, source)); + cont.push(getContentForNonChart(revision, null, getAppCurrentVersion(application), 0, source)); } return <>{cont}; } else { diff --git a/ui/src/app/applications/components/utils.tsx b/ui/src/app/applications/components/utils.tsx index b20dedfe7a25a..7b6e2437d92d8 100644 --- a/ui/src/app/applications/components/utils.tsx +++ b/ui/src/app/applications/components/utils.tsx @@ -1131,9 +1131,9 @@ export function getAppDefaultOperationSyncRevision(app?: appModels.Application) // getAppCurrentVersion gets the first app revisions from `status.sync.revisions` or, if that list is missing or empty, the `revision` // field. -export function getAppCurrentVersion(app?: appModels.Application) { - if (!app || !app.status || !app.status.history) { - return 0; +export function getAppCurrentVersion(app?: appModels.Application): number | null { + if (!app || !app.status || !app.status.history || app.status.history.length === 0) { + return null; } return app.status.history[app.status.history.length - 1].id; } diff --git a/ui/src/app/shared/services/applications-service.ts b/ui/src/app/shared/services/applications-service.ts index c131e9cf592c7..1f7b5eb684416 100644 --- a/ui/src/app/shared/services/applications-service.ts +++ b/ui/src/app/shared/services/applications-service.ts @@ -53,22 +53,26 @@ export class ApplicationsService { .then(res => res.body as models.ApplicationSyncWindowState); } - public revisionMetadata(name: string, appNamespace: string, revision: string, sourceIndex: number, versionId: number): Promise { - return requests - .get(`/applications/${name}/revisions/${revision || 'HEAD'}/metadata`) - .query({appNamespace}) - .query({sourceIndex}) - .query({versionId}) - .then(res => res.body as models.RevisionMetadata); + public revisionMetadata(name: string, appNamespace: string, revision: string, sourceIndex: number | null, versionId: number | null): Promise { + let r = requests.get(`/applications/${name}/revisions/${revision || 'HEAD'}/metadata`).query({appNamespace}); + if (sourceIndex !== null) { + r = r.query({sourceIndex}); + } + if (versionId !== null) { + r = r.query({versionId}); + } + return r.then(res => res.body as models.RevisionMetadata); } public revisionChartDetails(name: string, appNamespace: string, revision: string, sourceIndex: number, versionId: number): Promise { - return requests - .get(`/applications/${name}/revisions/${revision || 'HEAD'}/chartdetails`) - .query({appNamespace}) - .query({sourceIndex}) - .query({versionId}) - .then(res => res.body as models.ChartDetails); + let r = requests.get(`/applications/${name}/revisions/${revision || 'HEAD'}/chartdetails`).query({appNamespace}); + if (sourceIndex !== null) { + r = r.query({sourceIndex}); + } + if (versionId !== null) { + r = r.query({versionId}); + } + return r.then(res => res.body as models.ChartDetails); } public resourceTree(name: string, appNamespace: string): Promise { From 9d72f1ec5cdb25b38303fdd41b51a24b93723d0d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Jun 2024 09:29:04 -0400 Subject: [PATCH 09/23] chore(deps): bump tj-actions/changed-files from 44.5.3 to 44.5.4 (#18792) Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 44.5.3 to 44.5.4. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](https://github.com/tj-actions/changed-files/compare/eaf854ef0c266753e1abec356dcf17d92695b251...cc3bbb0c526f8ee1d282f8c5f9f4e50745a5b457) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-build.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml index 4dd652a4745bc..101d952bc75e6 100644 --- a/.github/workflows/ci-build.yaml +++ b/.github/workflows/ci-build.yaml @@ -31,7 +31,7 @@ jobs: docs: ${{ steps.filter.outputs.docs_any_changed }} steps: - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0 - - uses: tj-actions/changed-files@eaf854ef0c266753e1abec356dcf17d92695b251 # v44.5.3 + - uses: tj-actions/changed-files@cc3bbb0c526f8ee1d282f8c5f9f4e50745a5b457 # v44.5.4 id: filter with: # Any file which is not under docs/, ui/ or is not a markdown file is counted as a backend file From 25e3a61938834af08761f5e814f12030a1becce7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Jun 2024 09:29:37 -0400 Subject: [PATCH 10/23] chore(deps): bump docker/build-push-action from 6.0.2 to 6.1.0 (#18791) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.0.2 to 6.1.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f6010ea70151369b06f0194be1051fbbdff851b2...31159d49c0d4756269a0940a750801a1ea5d7003) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/image-reuse.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/image-reuse.yaml b/.github/workflows/image-reuse.yaml index 7697d86dce33f..269640de21e26 100644 --- a/.github/workflows/image-reuse.yaml +++ b/.github/workflows/image-reuse.yaml @@ -143,7 +143,7 @@ jobs: - name: Build and push container image id: image - uses: docker/build-push-action@f6010ea70151369b06f0194be1051fbbdff851b2 #v6.0.2 + uses: docker/build-push-action@31159d49c0d4756269a0940a750801a1ea5d7003 #v6.1.0 with: context: . platforms: ${{ inputs.platforms }} From c95d4eef588c25a331ee556f60071e1a0c8a5eeb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Jun 2024 10:50:58 -0400 Subject: [PATCH 11/23] chore(deps): bump library/node from `5e4044f` to `b98ec1c` in /ui-test (#18790) Bumps library/node from `5e4044f` to `b98ec1c`. --- updated-dependencies: - dependency-name: library/node dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- ui-test/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui-test/Dockerfile b/ui-test/Dockerfile index 88bf92ec46261..442a9a573b507 100644 --- a/ui-test/Dockerfile +++ b/ui-test/Dockerfile @@ -1,4 +1,4 @@ -FROM docker.io/library/node:22.3.0@sha256:5e4044ff6001d06e7748e35bfa4f80c73cf5f5a7360a1b782995e038a01b0585 as node +FROM docker.io/library/node:22.3.0@sha256:b98ec1c96103fbe1a9e449b3854bbc0a0ed1c5936882ae0939d4c3a771265b4b as node RUN apt-get update && apt-get install --no-install-recommends -y \ software-properties-common From ad6508b9deb8d4fd5e0590e53e97dffc4b5c298d Mon Sep 17 00:00:00 2001 From: Keith Chong Date: Mon, 24 Jun 2024 13:08:16 -0400 Subject: [PATCH 12/23] fix: Bug in edit support in Sources tab; Input to loader (#17588) (#18800) --- .../application-parameters.tsx | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/ui/src/app/applications/components/application-parameters/application-parameters.tsx b/ui/src/app/applications/components/application-parameters/application-parameters.tsx index 3961b61d26656..9f5073a838bad 100644 --- a/ui/src/app/applications/components/application-parameters/application-parameters.tsx +++ b/ui/src/app/applications/components/application-parameters/application-parameters.tsx @@ -247,7 +247,7 @@ export const ApplicationParameters = (props: { )} - getSourceFromSources(application, index)}> + getSourceFromAppSources(src, app.metadata.name, app.spec.project, index, 0)}> {(details: models.RepoAppDetails) => getEditablePanelForOneSource(details, index, source)} @@ -986,17 +986,12 @@ function gatherDetails( } // For Sources field. Get one source with index i from the list -async function getSourceFromSources(app: models.Application, i: number) { - const sources: models.ApplicationSource[] = app.spec.sources; - if (sources && i < sources.length) { - const aSource = sources[i]; - const repoDetail = await services.repos.appDetails(aSource, app.metadata.name, app.spec.project, i, 0).catch(() => ({ - type: 'Directory' as models.AppSourceType, - path: aSource.path - })); - return repoDetail; - } - return null; +async function getSourceFromAppSources(aSource: models.ApplicationSource, name: string, project: string, index: number, version: number) { + const repoDetail = await services.repos.appDetails(aSource, name, project, index, version).catch(() => ({ + type: 'Directory' as models.AppSourceType, + path: aSource.path + })); + return repoDetail; } // Delete when source field is removed From b35acd4ffec827dfbf06fd4ea55d37ea4e2c67e9 Mon Sep 17 00:00:00 2001 From: adam tombleson Date: Mon, 24 Jun 2024 23:29:48 +0300 Subject: [PATCH 13/23] docs: fix minor typo on ingress page (#18799) Signed-off-by: adam tombleson --- docs/operator-manual/ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/operator-manual/ingress.md b/docs/operator-manual/ingress.md index a46853546a28a..2a462e9601349 100644 --- a/docs/operator-manual/ingress.md +++ b/docs/operator-manual/ingress.md @@ -617,7 +617,7 @@ Edit the `--insecure` flag in the `argocd-server` command of the argocd-server d ### Creating a service -Now you need an externally accessible service. This is practically the same as the internal service Argo CD has, but with Google Cloud annotations. Note that this service is annotated to use a [Network Endpoint Group](https://cloud.google.com/load-balancing/docs/negs) (NEG) to allow your load balancer to send traffic directly to your pods without using kube-proxy, so remove the `neg` annotation it that's not what you want. +Now you need an externally accessible service. This is practically the same as the internal service Argo CD has, but with Google Cloud annotations. Note that this service is annotated to use a [Network Endpoint Group](https://cloud.google.com/load-balancing/docs/negs) (NEG) to allow your load balancer to send traffic directly to your pods without using kube-proxy, so remove the `neg` annotation if that's not what you want. The service: From 587c5ba1c68681ef0ecfac5c4486868d6f14ffba Mon Sep 17 00:00:00 2001 From: Justin Marquis <76892343+34fathombelow@users.noreply.github.com> Date: Mon, 24 Jun 2024 13:47:36 -0700 Subject: [PATCH 14/23] chore: provide a better example of using cosign (#18803) Signed-off-by: Justin Marquis --- docs/operator-manual/signed-release-assets.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/operator-manual/signed-release-assets.md b/docs/operator-manual/signed-release-assets.md index b574876345b5b..3c42b27fd4e10 100644 --- a/docs/operator-manual/signed-release-assets.md +++ b/docs/operator-manual/signed-release-assets.md @@ -32,7 +32,8 @@ Argo CD container images are signed by [cosign](https://github.com/sigstore/cosi cosign verify \ --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ -quay.io/argoproj/argocd:v2.7.0 | jq +--certificate-github-workflow-repository "argoproj/argo-cd" \ +quay.io/argoproj/argocd:v2.11.3 | jq ``` The command should output the following if the container image was correctly verified: ```bash From 41b8e4406b342c732148f1fd7e5905220371c0ba Mon Sep 17 00:00:00 2001 From: Jessie Teng <101035990+JessieTeng89@users.noreply.github.com> Date: Tue, 25 Jun 2024 05:07:06 +0800 Subject: [PATCH 15/23] fix(ui): break external links to lines for each (#17679) (#18768) * break external links to lines for each Signed-off-by: Jessie Teng * update for better layout css style Signed-off-by: Jessie Teng --------- Signed-off-by: Jessie Teng Co-authored-by: Jessie Teng --- .../application-summary.scss | 10 ++++++++++ .../application-summary.tsx | 18 +++++++++++------- 2 files changed, 21 insertions(+), 7 deletions(-) diff --git a/ui/src/app/applications/components/application-summary/application-summary.scss b/ui/src/app/applications/components/application-summary/application-summary.scss index 408feb30da01c..a791ca323eeb0 100644 --- a/ui/src/app/applications/components/application-summary/application-summary.scss +++ b/ui/src/app/applications/components/application-summary/application-summary.scss @@ -42,6 +42,16 @@ right: 1em; } + &__links-rows { + margin: 10px 0; + } + + &__links-row { + display: flex; + align-items: center; + height: 35px; + } + .argo-field { line-height: 1.15; } diff --git a/ui/src/app/applications/components/application-summary/application-summary.tsx b/ui/src/app/applications/components/application-summary/application-summary.tsx index 1747e943af69f..00959c4016445 100644 --- a/ui/src/app/applications/components/application-summary/application-summary.tsx +++ b/ui/src/app/applications/components/application-summary/application-summary.tsx @@ -340,13 +340,17 @@ export const ApplicationSummary = (props: ApplicationSummaryProps) => { title: 'URLs', view: ( - {urls - .map(item => item.split('|')) - .map((parts, i) => ( - 1 ? parts[1] : parts[0]} target='__blank'> - {parts[0]}   - - ))} +
+ {urls + .map(item => item.split('|')) + .map((parts, i) => ( + + ))} +
) }); From f11de952a65cde1ee1779e22e1e487b9300a5956 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 10:15:27 -0400 Subject: [PATCH 16/23] chore(deps): bump tj-actions/changed-files from 44.5.4 to 44.5.5 (#18809) Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 44.5.4 to 44.5.5. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](https://github.com/tj-actions/changed-files/compare/cc3bbb0c526f8ee1d282f8c5f9f4e50745a5b457...cc733854b1f224978ef800d29e4709d5ee2883e4) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-build.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml index 101d952bc75e6..b03f578445dec 100644 --- a/.github/workflows/ci-build.yaml +++ b/.github/workflows/ci-build.yaml @@ -31,7 +31,7 @@ jobs: docs: ${{ steps.filter.outputs.docs_any_changed }} steps: - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0 - - uses: tj-actions/changed-files@cc3bbb0c526f8ee1d282f8c5f9f4e50745a5b457 # v44.5.4 + - uses: tj-actions/changed-files@cc733854b1f224978ef800d29e4709d5ee2883e4 # v44.5.5 id: filter with: # Any file which is not under docs/, ui/ or is not a markdown file is counted as a backend file From b92e00d5980dfa0e39e9ccfe61ec7b0961e91c44 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 10:16:15 -0400 Subject: [PATCH 17/23] chore(deps): bump github.com/hashicorp/go-retryablehttp (#18805) Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.4 to 0.7.7. - [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.7) --- updated-dependencies: - dependency-name: github.com/hashicorp/go-retryablehttp dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 16 ++++++++++------ 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/go.mod b/go.mod index 667d476eabd9f..a981c35e61ec9 100644 --- a/go.mod +++ b/go.mod @@ -52,14 +52,14 @@ require ( github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 github.com/grpc-ecosystem/grpc-gateway v1.16.0 - github.com/hashicorp/go-retryablehttp v0.7.4 + github.com/hashicorp/go-retryablehttp v0.7.7 github.com/imdario/mergo v0.3.16 github.com/improbable-eng/grpc-web v0.15.0 github.com/itchyny/gojq v0.12.13 github.com/jeremywohl/flatten v1.0.1 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 github.com/ktrysmt/go-bitbucket v0.9.67 - github.com/mattn/go-isatty v0.0.19 + github.com/mattn/go-isatty v0.0.20 github.com/mattn/go-zglob v0.0.4 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 diff --git a/go.sum b/go.sum index 58bf8a9315598..f839f1489fab0 100644 --- a/go.sum +++ b/go.sum @@ -892,6 +892,8 @@ github.com/facebookgo/subset v0.0.0-20150612182917-8dac2c3c4870/go.mod h1:5tD+ne github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8= github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= +github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= +github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk= github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= @@ -1242,14 +1244,14 @@ github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtng github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= -github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI= -github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ= +github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k= +github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM= github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= github.com/hashicorp/go-retryablehttp v0.5.1/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs= -github.com/hashicorp/go-retryablehttp v0.7.4 h1:ZQgVdpTdAL7WpMIwLzCfbalOcSUdkDZnpUv3/+BxzFA= -github.com/hashicorp/go-retryablehttp v0.7.4/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8= +github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU= +github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk= github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU= github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU= github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4= @@ -1383,13 +1385,15 @@ github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsI github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= +github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= +github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= -github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA= -github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= From 13b70c56ce8e664193548df6aff06d32851caabf Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 08:56:15 -0700 Subject: [PATCH 18/23] [Bot] docs: Update Snyk reports (#18772) Signed-off-by: CI Co-authored-by: CI --- docs/snyk/index.md | 22 +- docs/snyk/master/argocd-iac-install.html | 10 +- .../master/argocd-iac-namespace-install.html | 10 +- docs/snyk/master/argocd-test.html | 2 +- .../master/ghcr.io_dexidp_dex_v2.38.0.html | 3 +- ..._docker_library_haproxy_2.6.17-alpine.html | 2 +- ...ws_docker_library_redis_7.0.15-alpine.html | 375 +- .../quay.io_argoproj_argocd_latest.html | 3 +- docs/snyk/master/redis_7.0.15-alpine.html | 375 +- docs/snyk/v2.10.12/argocd-iac-install.html | 2 +- .../argocd-iac-namespace-install.html | 2 +- docs/snyk/v2.10.12/argocd-test.html | 2 +- .../v2.10.12/ghcr.io_dexidp_dex_v2.37.0.html | 4 +- docs/snyk/v2.10.12/haproxy_2.6.14-alpine.html | 3 +- .../quay.io_argoproj_argocd_v2.10.12.html | 3 +- docs/snyk/v2.10.12/redis_7.0.15-alpine.html | 375 +- docs/snyk/v2.11.3/argocd-iac-install.html | 2 +- .../v2.11.3/argocd-iac-namespace-install.html | 2 +- docs/snyk/v2.11.3/argocd-test.html | 2 +- .../v2.11.3/ghcr.io_dexidp_dex_v2.38.0.html | 3 +- docs/snyk/v2.11.3/haproxy_2.6.14-alpine.html | 3 +- .../quay.io_argoproj_argocd_v2.11.3.html | 3 +- docs/snyk/v2.11.3/redis_7.0.14-alpine.html | 3 +- docs/snyk/v2.12.0-rc1/argocd-iac-install.html | 2891 ++++++++++++++ .../argocd-iac-namespace-install.html | 2845 ++++++++++++++ docs/snyk/v2.12.0-rc1/argocd-test.html | 1283 +++++++ .../ghcr.io_dexidp_dex_v2.38.0.html | 3420 +++++++++++++++++ ..._docker_library_haproxy_2.6.17-alpine.html | 890 +++++ ...ws_docker_library_redis_7.0.15-alpine.html | 484 +++ .../quay.io_argoproj_argocd_v2.12.0-rc1.html | 2988 ++++++++++++++ .../snyk/v2.12.0-rc1/redis_7.0.15-alpine.html | 484 +++ docs/snyk/v2.9.17/argocd-iac-install.html | 2 +- .../v2.9.17/argocd-iac-namespace-install.html | 2 +- docs/snyk/v2.9.17/argocd-test.html | 2 +- .../v2.9.17/ghcr.io_dexidp_dex_v2.37.0.html | 4 +- docs/snyk/v2.9.17/haproxy_2.6.14-alpine.html | 3 +- .../quay.io_argoproj_argocd_v2.9.17.html | 3 +- docs/snyk/v2.9.17/redis_7.0.15-alpine.html | 375 +- 38 files changed, 15370 insertions(+), 1517 deletions(-) create mode 100644 docs/snyk/v2.12.0-rc1/argocd-iac-install.html create mode 100644 docs/snyk/v2.12.0-rc1/argocd-iac-namespace-install.html create mode 100644 docs/snyk/v2.12.0-rc1/argocd-test.html create mode 100644 docs/snyk/v2.12.0-rc1/ghcr.io_dexidp_dex_v2.38.0.html create mode 100644 docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html create mode 100644 docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html create mode 100644 docs/snyk/v2.12.0-rc1/quay.io_argoproj_argocd_v2.12.0-rc1.html create mode 100644 docs/snyk/v2.12.0-rc1/redis_7.0.15-alpine.html diff --git a/docs/snyk/index.md b/docs/snyk/index.md index 0b14ff28d76d5..0d30a7733f3bb 100644 --- a/docs/snyk/index.md +++ b/docs/snyk/index.md @@ -17,12 +17,26 @@ recent minor releases. | [ui/yarn.lock](master/argocd-test.html) | 0 | 0 | 1 | 0 | | [dex:v2.38.0](master/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 3 | | [haproxy:2.6.17-alpine](master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 1 | -| [redis:7.0.15-alpine](master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 2 | 1 | +| [redis:7.0.15-alpine](master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 0 | | [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 3 | 11 | -| [redis:7.0.15-alpine](master/redis_7.0.15-alpine.html) | 0 | 0 | 2 | 1 | +| [redis:7.0.15-alpine](master/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 0 | | [install.yaml](master/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](master/argocd-iac-namespace-install.html) | - | - | - | - | +### v2.12.0-rc1 + +| | Critical | High | Medium | Low | +|---:|:--------:|:----:|:------:|:---:| +| [go.mod](v2.12.0-rc1/argocd-test.html) | 0 | 0 | 7 | 0 | +| [ui/yarn.lock](v2.12.0-rc1/argocd-test.html) | 0 | 0 | 1 | 0 | +| [dex:v2.38.0](v2.12.0-rc1/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 3 | +| [haproxy:2.6.17-alpine](v2.12.0-rc1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 1 | +| [redis:7.0.15-alpine](v2.12.0-rc1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 0 | +| [argocd:v2.12.0-rc1](v2.12.0-rc1/quay.io_argoproj_argocd_v2.12.0-rc1.html) | 0 | 0 | 3 | 11 | +| [redis:7.0.15-alpine](v2.12.0-rc1/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 0 | +| [install.yaml](v2.12.0-rc1/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.12.0-rc1/argocd-iac-namespace-install.html) | - | - | - | - | + ### v2.11.3 | | Critical | High | Medium | Low | @@ -45,7 +59,7 @@ recent minor releases. | [dex:v2.37.0](v2.10.12/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 1 | 10 | 3 | | [haproxy:2.6.14-alpine](v2.10.12/haproxy_2.6.14-alpine.html) | 0 | 1 | 7 | 3 | | [argocd:v2.10.12](v2.10.12/quay.io_argoproj_argocd_v2.10.12.html) | 0 | 0 | 4 | 19 | -| [redis:7.0.15-alpine](v2.10.12/redis_7.0.15-alpine.html) | 0 | 0 | 2 | 1 | +| [redis:7.0.15-alpine](v2.10.12/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 0 | | [install.yaml](v2.10.12/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.10.12/argocd-iac-namespace-install.html) | - | - | - | - | @@ -58,6 +72,6 @@ recent minor releases. | [dex:v2.37.0](v2.9.17/ghcr.io_dexidp_dex_v2.37.0.html) | 1 | 1 | 10 | 3 | | [haproxy:2.6.14-alpine](v2.9.17/haproxy_2.6.14-alpine.html) | 0 | 1 | 7 | 3 | | [argocd:v2.9.17](v2.9.17/quay.io_argoproj_argocd_v2.9.17.html) | 0 | 0 | 4 | 19 | -| [redis:7.0.15-alpine](v2.9.17/redis_7.0.15-alpine.html) | 0 | 0 | 2 | 1 | +| [redis:7.0.15-alpine](v2.9.17/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 0 | | [install.yaml](v2.9.17/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.9.17/argocd-iac-namespace-install.html) | - | - | - | - | diff --git a/docs/snyk/master/argocd-iac-install.html b/docs/snyk/master/argocd-iac-install.html index 7c5eefc353e7c..3e493a5a72da9 100644 --- a/docs/snyk/master/argocd-iac-install.html +++ b/docs/snyk/master/argocd-iac-install.html @@ -456,7 +456,7 @@

Snyk test report

-

June 16th 2024, 12:18:10 am (UTC+00:00)

+

June 23rd 2024, 12:18:38 am (UTC+00:00)

Scanned the following path: @@ -1513,7 +1513,7 @@

Container has no CPU limit

  • - Line number: 22770 + Line number: 22794
    • @@ -2301,7 +2301,7 @@

    Container is running without memory limit

  • - Line number: 22770 + Line number: 22794
    • @@ -2805,7 +2805,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 22680 + Line number: 22704
    • @@ -2861,7 +2861,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 22971 + Line number: 22995
    • diff --git a/docs/snyk/master/argocd-iac-namespace-install.html b/docs/snyk/master/argocd-iac-namespace-install.html index 2a7537570f30a..eee204215bf2f 100644 --- a/docs/snyk/master/argocd-iac-namespace-install.html +++ b/docs/snyk/master/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:18:18 am (UTC+00:00)

    +

    June 23rd 2024, 12:18:57 am (UTC+00:00)

    Scanned the following path: @@ -1467,7 +1467,7 @@

    Container has no CPU limit

  • - Line number: 1847 + Line number: 1871
    • @@ -2255,7 +2255,7 @@

    Container is running without memory limit

  • - Line number: 1847 + Line number: 1871
    • @@ -2759,7 +2759,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 1757 + Line number: 1781
    • @@ -2815,7 +2815,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 2048 + Line number: 2072
    • diff --git a/docs/snyk/master/argocd-test.html b/docs/snyk/master/argocd-test.html index 052e1be87ae85..18a35f099d36d 100644 --- a/docs/snyk/master/argocd-test.html +++ b/docs/snyk/master/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:16:13 am (UTC+00:00)

    +

    June 23rd 2024, 12:16:21 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/master/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/master/ghcr.io_dexidp_dex_v2.38.0.html index ab099a1d4273b..65a088bec9f10 100644 --- a/docs/snyk/master/ghcr.io_dexidp_dex_v2.38.0.html +++ b/docs/snyk/master/ghcr.io_dexidp_dex_v2.38.0.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:16:20 am (UTC+00:00)

    +

    June 23rd 2024, 12:16:33 am (UTC+00:00)

    Scanned the following paths: @@ -3402,6 +3402,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index c56a47dcd2455..0c6be993e8ce2 100644 --- a/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:16:25 am (UTC+00:00)

    +

    June 23rd 2024, 12:16:44 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index 1d67bfcaf8fc3..2cb7b0d3e3e3d 100644 --- a/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:16:29 am (UTC+00:00)

    +

    June 23rd 2024, 12:16:53 am (UTC+00:00)

    Scanned the following paths: @@ -467,8 +467,8 @@

    Snyk test report

    -
    3 known vulnerabilities
    -
    19 vulnerable dependency paths
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    18 dependencies
    @@ -476,372 +476,7 @@

    Snyk test report

    -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    CVE-2024-4741

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine and openssl/libcrypto3@3.3.0-r2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|public.ecr.aws/docker/library/redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    This vulnerability has not been analyzed by NVD yet.

    -

    Remediation

    -

    Upgrade Alpine:3.20 openssl to version 3.3.0-r3 or higher.

    - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    + No known vulnerabilities detected.
    diff --git a/docs/snyk/master/quay.io_argoproj_argocd_latest.html b/docs/snyk/master/quay.io_argoproj_argocd_latest.html index 39c8c86bb5d2d..a618728cda5da 100644 --- a/docs/snyk/master/quay.io_argoproj_argocd_latest.html +++ b/docs/snyk/master/quay.io_argoproj_argocd_latest.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:16:46 am (UTC+00:00)

    +

    June 23rd 2024, 12:17:09 am (UTC+00:00)

    Scanned the following paths: @@ -1967,6 +1967,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/master/redis_7.0.15-alpine.html b/docs/snyk/master/redis_7.0.15-alpine.html index acd74bb326905..6c4768101cc01 100644 --- a/docs/snyk/master/redis_7.0.15-alpine.html +++ b/docs/snyk/master/redis_7.0.15-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:16:50 am (UTC+00:00)

    +

    June 23rd 2024, 12:17:13 am (UTC+00:00)

    Scanned the following paths: @@ -467,8 +467,8 @@

    Snyk test report

    -
    3 known vulnerabilities
    -
    19 vulnerable dependency paths
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    18 dependencies
    @@ -476,372 +476,7 @@

    Snyk test report

    -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    CVE-2024-4741

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and openssl/libcrypto3@3.3.0-r2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    This vulnerability has not been analyzed by NVD yet.

    -

    Remediation

    -

    Upgrade Alpine:3.20 openssl to version 3.3.0-r3 or higher.

    - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    + No known vulnerabilities detected.
    diff --git a/docs/snyk/v2.10.12/argocd-iac-install.html b/docs/snyk/v2.10.12/argocd-iac-install.html index 6a8ba1ca661f5..7beea0b930d83 100644 --- a/docs/snyk/v2.10.12/argocd-iac-install.html +++ b/docs/snyk/v2.10.12/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:22:32 am (UTC+00:00)

    +

    June 23rd 2024, 12:26:05 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.10.12/argocd-iac-namespace-install.html b/docs/snyk/v2.10.12/argocd-iac-namespace-install.html index 3cd5485060f32..520bf174aa44f 100644 --- a/docs/snyk/v2.10.12/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.10.12/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:22:41 am (UTC+00:00)

    +

    June 23rd 2024, 12:26:14 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.10.12/argocd-test.html b/docs/snyk/v2.10.12/argocd-test.html index ddb502a8683df..933440fdb49f9 100644 --- a/docs/snyk/v2.10.12/argocd-test.html +++ b/docs/snyk/v2.10.12/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:20:42 am (UTC+00:00)

    +

    June 23rd 2024, 12:24:08 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.10.12/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.10.12/ghcr.io_dexidp_dex_v2.37.0.html index 61dda6fca436a..b831e5d676609 100644 --- a/docs/snyk/v2.10.12/ghcr.io_dexidp_dex_v2.37.0.html +++ b/docs/snyk/v2.10.12/ghcr.io_dexidp_dex_v2.37.0.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:20:48 am (UTC+00:00)

    +

    June 23rd 2024, 12:24:16 am (UTC+00:00)

    Scanned the following paths: @@ -1722,6 +1722,7 @@

    References

  • https://security.netapp.com/advisory/ntap-20231027-0008/
  • http://www.openwall.com/lists/oss-security/2023/11/06/2
  • https://security.gentoo.org/glsa/202402-08
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0006/
    • @@ -5188,6 +5189,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.10.12/haproxy_2.6.14-alpine.html b/docs/snyk/v2.10.12/haproxy_2.6.14-alpine.html index 808120d96d9a7..d39f21fb89a63 100644 --- a/docs/snyk/v2.10.12/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.10.12/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:20:52 am (UTC+00:00)

    +

    June 23rd 2024, 12:24:20 am (UTC+00:00)

    Scanned the following path: @@ -2182,6 +2182,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.10.12/quay.io_argoproj_argocd_v2.10.12.html b/docs/snyk/v2.10.12/quay.io_argoproj_argocd_v2.10.12.html index ad04736403f86..ae47ad618d073 100644 --- a/docs/snyk/v2.10.12/quay.io_argoproj_argocd_v2.10.12.html +++ b/docs/snyk/v2.10.12/quay.io_argoproj_argocd_v2.10.12.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:21:08 am (UTC+00:00)

    +

    June 23rd 2024, 12:24:37 am (UTC+00:00)

    Scanned the following paths: @@ -2576,6 +2576,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.10.12/redis_7.0.15-alpine.html b/docs/snyk/v2.10.12/redis_7.0.15-alpine.html index b2c73a984eee9..d6605a455eaf0 100644 --- a/docs/snyk/v2.10.12/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.10.12/redis_7.0.15-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:21:13 am (UTC+00:00)

    +

    June 23rd 2024, 12:24:41 am (UTC+00:00)

    Scanned the following paths: @@ -467,8 +467,8 @@

    Snyk test report

    -
    3 known vulnerabilities
    -
    19 vulnerable dependency paths
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    18 dependencies
    @@ -476,372 +476,7 @@

    Snyk test report

    -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    CVE-2024-4741

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and openssl/libcrypto3@3.3.0-r2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    This vulnerability has not been analyzed by NVD yet.

    -

    Remediation

    -

    Upgrade Alpine:3.20 openssl to version 3.3.0-r3 or higher.

    - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    + No known vulnerabilities detected.
    diff --git a/docs/snyk/v2.11.3/argocd-iac-install.html b/docs/snyk/v2.11.3/argocd-iac-install.html index 2dc45d9f164b0..efb934c179484 100644 --- a/docs/snyk/v2.11.3/argocd-iac-install.html +++ b/docs/snyk/v2.11.3/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:20:24 am (UTC+00:00)

    +

    June 23rd 2024, 12:23:46 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.3/argocd-iac-namespace-install.html b/docs/snyk/v2.11.3/argocd-iac-namespace-install.html index cb97e86b53b51..0ed43cb846536 100644 --- a/docs/snyk/v2.11.3/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.11.3/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:20:33 am (UTC+00:00)

    +

    June 23rd 2024, 12:23:57 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.3/argocd-test.html b/docs/snyk/v2.11.3/argocd-test.html index 3ee33ce5e4888..a993acba5d478 100644 --- a/docs/snyk/v2.11.3/argocd-test.html +++ b/docs/snyk/v2.11.3/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:18:30 am (UTC+00:00)

    +

    June 23rd 2024, 12:21:36 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.11.3/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/v2.11.3/ghcr.io_dexidp_dex_v2.38.0.html index ef7e16fc72a57..0fd2cc209be7e 100644 --- a/docs/snyk/v2.11.3/ghcr.io_dexidp_dex_v2.38.0.html +++ b/docs/snyk/v2.11.3/ghcr.io_dexidp_dex_v2.38.0.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:18:36 am (UTC+00:00)

    +

    June 23rd 2024, 12:21:44 am (UTC+00:00)

    Scanned the following paths: @@ -3402,6 +3402,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.11.3/haproxy_2.6.14-alpine.html b/docs/snyk/v2.11.3/haproxy_2.6.14-alpine.html index fa33763c2c255..288ead4a38cdb 100644 --- a/docs/snyk/v2.11.3/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.11.3/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:18:41 am (UTC+00:00)

    +

    June 23rd 2024, 12:21:58 am (UTC+00:00)

    Scanned the following path: @@ -2182,6 +2182,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.11.3/quay.io_argoproj_argocd_v2.11.3.html b/docs/snyk/v2.11.3/quay.io_argoproj_argocd_v2.11.3.html index f4f1f66704dd0..ff4571bdbcfd3 100644 --- a/docs/snyk/v2.11.3/quay.io_argoproj_argocd_v2.11.3.html +++ b/docs/snyk/v2.11.3/quay.io_argoproj_argocd_v2.11.3.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:18:59 am (UTC+00:00)

    +

    June 23rd 2024, 12:22:18 am (UTC+00:00)

    Scanned the following paths: @@ -2576,6 +2576,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.11.3/redis_7.0.14-alpine.html b/docs/snyk/v2.11.3/redis_7.0.14-alpine.html index 76b8256a89710..8696322e9c592 100644 --- a/docs/snyk/v2.11.3/redis_7.0.14-alpine.html +++ b/docs/snyk/v2.11.3/redis_7.0.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:19:04 am (UTC+00:00)

    +

    June 23rd 2024, 12:22:23 am (UTC+00:00)

    Scanned the following paths: @@ -1798,6 +1798,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.12.0-rc1/argocd-iac-install.html b/docs/snyk/v2.12.0-rc1/argocd-iac-install.html new file mode 100644 index 0000000000000..d2b11c2d16ae7 --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/argocd-iac-install.html @@ -0,0 +1,2891 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:21:13 am (UTC+00:00)

    +
    +
    + Scanned the following path: +
      +
    • /argo-cd/manifests/install.yaml (Kubernetes)
      • +
    +
    + +
    +
    44 total issues
    +
    +
    +
    +
    + +
    + + + + + + +
    Project manifests/install.yaml
    Path /argo-cd/manifests/install.yaml
    Project Type Kubernetes
    +
    +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 17] + › + rules[5] + › + resources + +
      • + +
    • + Line number: 21103 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 10] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 20788 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 11] + › + rules[4] + › + resources + +
      • + +
    • + Line number: 20873 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 12] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 20901 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 13] + › + rules[1] + › + resources + +
      • + +
    • + Line number: 20931 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 13] + › + rules[3] + › + resources + +
      • + +
    • + Line number: 20949 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 14] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 20967 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 15] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 20989 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container could be running with outdated image

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-42 +
      • + +
    • Introduced through: + [DocId: 48] + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + imagePullPolicy + +
      • + +
    • + Line number: 22035 +
      • +
    + +
    + +

    Impact

    +

    The container may run with outdated or unauthorized image

    + +

    Remediation

    +

    Set `imagePullPolicy` attribute to `Always`

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container could be running with outdated image

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-42 +
      • + +
    • Introduced through: + [DocId: 49] + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + imagePullPolicy + +
      • + +
    • + Line number: 22334 +
      • +
    + +
    + +

    Impact

    +

    The container may run with outdated or unauthorized image

    + +

    Remediation

    +

    Set `imagePullPolicy` attribute to `Always`

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 45] + › + input + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 21596 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 46] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 21847 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 46] + › + input + › + spec + › + template + › + spec + › + containers[dex] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 21813 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 47] + › + input + › + spec + › + template + › + spec + › + containers[argocd-notifications-controller] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 21907 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 48] + › + input + › + spec + › + template + › + spec + › + containers[redis] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 22006 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 48] + › + input + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 22030 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 49] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 22334 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 49] + › + input + › + spec + › + template + › + spec + › + containers[argocd-repo-server] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 22087 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 50] + › + input + › + spec + › + template + › + spec + › + containers[argocd-server] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 22419 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 51] + › + input + › + spec + › + template + › + spec + › + containers[argocd-application-controller] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 22770 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running with multiple open ports

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-36 +
      • + +
    • Introduced through: + [DocId: 46] + › + spec + › + template + › + spec + › + containers[dex] + › + ports + +
      • + +
    • + Line number: 21827 +
      • +
    + +
    + +

    Impact

    +

    Increases the attack surface of the application and the container.

    + +

    Remediation

    +

    Reduce `ports` count to 2

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without liveness probe

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-41 +
      • + +
    • Introduced through: + [DocId: 45] + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + livenessProbe + +
      • + +
    • + Line number: 21596 +
      • +
    + +
    + +

    Impact

    +

    Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

    + +

    Remediation

    +

    Add `livenessProbe` attribute

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without liveness probe

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-41 +
      • + +
    • Introduced through: + [DocId: 46] + › + spec + › + template + › + spec + › + containers[dex] + › + livenessProbe + +
      • + +
    • + Line number: 21813 +
      • +
    + +
    + +

    Impact

    +

    Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

    + +

    Remediation

    +

    Add `livenessProbe` attribute

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without liveness probe

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-41 +
      • + +
    • Introduced through: + [DocId: 48] + › + spec + › + template + › + spec + › + containers[redis] + › + livenessProbe + +
      • + +
    • + Line number: 22006 +
      • +
    + +
    + +

    Impact

    +

    Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

    + +

    Remediation

    +

    Add `livenessProbe` attribute

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 45] + › + input + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 21596 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 46] + › + input + › + spec + › + template + › + spec + › + containers[dex] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 21813 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 46] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 21847 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 47] + › + input + › + spec + › + template + › + spec + › + containers[argocd-notifications-controller] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 21907 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 48] + › + input + › + spec + › + template + › + spec + › + containers[redis] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 22006 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 48] + › + input + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 22030 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 49] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 22334 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 49] + › + input + › + spec + › + template + › + spec + › + containers[argocd-repo-server] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 22087 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 50] + › + input + › + spec + › + template + › + spec + › + containers[argocd-server] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 22419 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 51] + › + input + › + spec + › + template + › + spec + › + containers[argocd-application-controller] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 22770 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 45] + › + input + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 21737 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 46] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 21855 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 46] + › + input + › + spec + › + template + › + spec + › + containers[dex] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 21830 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 47] + › + input + › + spec + › + template + › + spec + › + containers[argocd-notifications-controller] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 21940 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 48] + › + input + › + spec + › + template + › + spec + › + containers[redis] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 22023 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 48] + › + input + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 22037 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 49] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 22341 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 49] + › + input + › + spec + › + template + › + spec + › + containers[argocd-repo-server] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 22307 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 50] + › + input + › + spec + › + template + › + spec + › + containers[argocd-server] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 22680 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 51] + › + input + › + spec + › + template + › + spec + › + containers[argocd-application-controller] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 22971 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +
    + +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/argocd-iac-namespace-install.html b/docs/snyk/v2.12.0-rc1/argocd-iac-namespace-install.html new file mode 100644 index 0000000000000..4ec7e8ad7199b --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/argocd-iac-namespace-install.html @@ -0,0 +1,2845 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:21:22 am (UTC+00:00)

    +
    +
    + Scanned the following path: +
      +
    • /argo-cd/manifests/namespace-install.yaml (Kubernetes)
      • +
    +
    + +
    +
    43 total issues
    +
    +
    +
    +
    + +
    + + + + + + +
    Project manifests/namespace-install.yaml
    Path /argo-cd/manifests/namespace-install.yaml
    Project Type Kubernetes
    +
    +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 7] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 77 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 8] + › + rules[4] + › + resources + +
      • + +
    • + Line number: 162 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 9] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 190 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 10] + › + rules[1] + › + resources + +
      • + +
    • + Line number: 220 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 10] + › + rules[3] + › + resources + +
      • + +
    • + Line number: 238 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 11] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 256 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Role or ClusterRole with dangerous permissions

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-47 +
      • + +
    • Introduced through: + [DocId: 12] + › + rules[0] + › + resources + +
      • + +
    • + Line number: 278 +
      • +
    + +
    + +

    Impact

    +

    Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

    + +

    Remediation

    +

    Consider removing these permissions

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container could be running with outdated image

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-42 +
      • + +
    • Introduced through: + [DocId: 39] + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + imagePullPolicy + +
      • + +
    • + Line number: 1112 +
      • +
    + +
    + +

    Impact

    +

    The container may run with outdated or unauthorized image

    + +

    Remediation

    +

    Set `imagePullPolicy` attribute to `Always`

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container could be running with outdated image

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-42 +
      • + +
    • Introduced through: + [DocId: 40] + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + imagePullPolicy + +
      • + +
    • + Line number: 1411 +
      • +
    + +
    + +

    Impact

    +

    The container may run with outdated or unauthorized image

    + +

    Remediation

    +

    Set `imagePullPolicy` attribute to `Always`

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 36] + › + input + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 673 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 37] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 924 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 37] + › + input + › + spec + › + template + › + spec + › + containers[dex] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 890 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 38] + › + input + › + spec + › + template + › + spec + › + containers[argocd-notifications-controller] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 984 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 39] + › + input + › + spec + › + template + › + spec + › + containers[redis] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 1083 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 39] + › + input + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 1107 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 40] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 1411 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 40] + › + input + › + spec + › + template + › + spec + › + containers[argocd-repo-server] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 1164 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 41] + › + input + › + spec + › + template + › + spec + › + containers[argocd-server] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 1496 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container has no CPU limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-5 +
      • + +
    • Introduced through: + [DocId: 42] + › + input + › + spec + › + template + › + spec + › + containers[argocd-application-controller] + › + resources + › + limits + › + cpu + +
      • + +
    • + Line number: 1847 +
      • +
    + +
    + +

    Impact

    +

    CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

    + +

    Remediation

    +

    Add `resources.limits.cpu` field with required CPU limit value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running with multiple open ports

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-36 +
      • + +
    • Introduced through: + [DocId: 37] + › + spec + › + template + › + spec + › + containers[dex] + › + ports + +
      • + +
    • + Line number: 904 +
      • +
    + +
    + +

    Impact

    +

    Increases the attack surface of the application and the container.

    + +

    Remediation

    +

    Reduce `ports` count to 2

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without liveness probe

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-41 +
      • + +
    • Introduced through: + [DocId: 36] + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + livenessProbe + +
      • + +
    • + Line number: 673 +
      • +
    + +
    + +

    Impact

    +

    Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

    + +

    Remediation

    +

    Add `livenessProbe` attribute

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without liveness probe

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-41 +
      • + +
    • Introduced through: + [DocId: 37] + › + spec + › + template + › + spec + › + containers[dex] + › + livenessProbe + +
      • + +
    • + Line number: 890 +
      • +
    + +
    + +

    Impact

    +

    Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

    + +

    Remediation

    +

    Add `livenessProbe` attribute

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without liveness probe

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-41 +
      • + +
    • Introduced through: + [DocId: 39] + › + spec + › + template + › + spec + › + containers[redis] + › + livenessProbe + +
      • + +
    • + Line number: 1083 +
      • +
    + +
    + +

    Impact

    +

    Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

    + +

    Remediation

    +

    Add `livenessProbe` attribute

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 36] + › + input + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 673 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 37] + › + input + › + spec + › + template + › + spec + › + containers[dex] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 890 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 37] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 924 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 38] + › + input + › + spec + › + template + › + spec + › + containers[argocd-notifications-controller] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 984 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 39] + › + input + › + spec + › + template + › + spec + › + containers[redis] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 1083 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 39] + › + input + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 1107 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 40] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 1411 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 40] + › + input + › + spec + › + template + › + spec + › + containers[argocd-repo-server] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 1164 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 41] + › + input + › + spec + › + template + › + spec + › + containers[argocd-server] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 1496 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container is running without memory limit

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-4 +
      • + +
    • Introduced through: + [DocId: 42] + › + input + › + spec + › + template + › + spec + › + containers[argocd-application-controller] + › + resources + › + limits + › + memory + +
      • + +
    • + Line number: 1847 +
      • +
    + +
    + +

    Impact

    +

    Containers without memory limits are more likely to be terminated when the node runs out of memory

    + +

    Remediation

    +

    Set `resources.limits.memory` value

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 36] + › + input + › + spec + › + template + › + spec + › + containers[argocd-applicationset-controller] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 814 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 37] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 932 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 37] + › + input + › + spec + › + template + › + spec + › + containers[dex] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 907 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 38] + › + input + › + spec + › + template + › + spec + › + containers[argocd-notifications-controller] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 1017 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 39] + › + input + › + spec + › + template + › + spec + › + containers[redis] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 1100 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 39] + › + input + › + spec + › + template + › + spec + › + initContainers[secret-init] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 1114 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 40] + › + input + › + spec + › + template + › + spec + › + initContainers[copyutil] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 1418 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 40] + › + input + › + spec + › + template + › + spec + › + containers[argocd-repo-server] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 1384 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 41] + › + input + › + spec + › + template + › + spec + › + containers[argocd-server] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 1757 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +

    Container's or Pod's UID could clash with host's UID

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Public ID: SNYK-CC-K8S-11 +
      • + +
    • Introduced through: + [DocId: 42] + › + input + › + spec + › + template + › + spec + › + containers[argocd-application-controller] + › + securityContext + › + runAsUser + +
      • + +
    • + Line number: 2048 +
      • +
    + +
    + +

    Impact

    +

    UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

    + +

    Remediation

    +

    Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

    + + +
    +
    + +
    +

    More about this issue

    +
    + +
    +
    +
    + +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/argocd-test.html b/docs/snyk/v2.12.0-rc1/argocd-test.html new file mode 100644 index 0000000000000..d05e76a9ce1ea --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/argocd-test.html @@ -0,0 +1,1283 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:19:11 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • /argo-cd/argoproj/argo-cd/v2/go.mod (gomodules)
      • +
    • /argo-cd/ui/yarn.lock (yarn)
      • +
    +
    + +
    +
    8 known vulnerabilities
    +
    26 vulnerable dependency paths
    +
    2059 dependencies
    +
    +
    +
    +
    + +
    +
    +
    +

    LGPL-3.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + gopkg.in/retry.v1 +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/Azure/kubelogin/pkg/token@0.0.20 + › + gopkg.in/retry.v1@1.0.3 + + + +
      • +
    + +
    + +
    + +

    LGPL-3.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/r3labs/diff +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/r3labs/diff@1.1.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/r3labs/diff@1.1.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-version +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.18.0 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + code.gitea.io/sdk/gitea@0.18.0 + › + github.com/hashicorp/go-version@1.6.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-retryablehttp +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/hashicorp/go-retryablehttp@0.7.4 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/xanzy/go-gitlab@0.91.1 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/cmd@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/api@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/controller@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/cmd@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/api@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/controller@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-cleanhttp +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/hashicorp/go-retryablehttp@0.7.4 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/xanzy/go-gitlab@0.91.1 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/xanzy/go-gitlab@0.91.1 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/cmd@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/api@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/argoproj/notifications-engine/pkg/controller@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/subscriptions@#0802cd427621 + › + github.com/argoproj/notifications-engine/pkg/services@#0802cd427621 + › + github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 + › + github.com/hashicorp/go-retryablehttp@0.7.4 + › + github.com/hashicorp/go-cleanhttp@0.5.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/gosimple/slug +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/gosimple/slug@1.13.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod +
      • +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + github.com/Azure/azure-sdk-for-go/sdk/azidentity +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/Azure/kubelogin/pkg/token@0.0.20 + › + github.com/Azure/azure-sdk-for-go/sdk/azidentity@1.1.0 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    github.com/Azure/azure-sdk-for-go/sdk/azidentity is a module that provides Microsoft Entra ID (formerly Azure Active Directory) token authentication support across the Azure SDK. It includes a set of TokenCredential implementations, which can be used with Azure SDK clients supporting token authentication.

    +

    Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only exploitable if the application is configured to use multiple threads or processes for handling authentication requests.

    +

    Notes:

    +
      +

    1. An attacker who successfully exploited the vulnerability could elevate privileges and read any file on the file system with SYSTEM access permissions;

      +
      2. +

    2. An attacker who successfully exploits this vulnerability can only obtain read access to the system files by exploiting this vulnerability. The attacker cannot perform write or delete operations on the files;

      +
      3. +

    3. The vulnerability exists in the following credential types: DefaultAzureCredential and ManagedIdentityCredential;

      +
      4. +

    4. The vulnerability exists in the following credential types:

      +
      5. +
    +

    ManagedIdentityApplication (.NET)

    +

    ManagedIdentityApplication (Java)

    +

    ManagedIdentityApplication (Node.js)

    +

    Remediation

    +

    Upgrade github.com/Azure/azure-sdk-for-go/sdk/azidentity to version 1.6.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Template Injection

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: /argo-cd › ui/yarn.lock +
      • +
    • + Package Manager: npm +
      • +
    • + Vulnerable module: + + dompurify +
      • + +
    • Introduced through: + + + argo-cd-ui@1.0.0, redoc@2.0.0-rc.64 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + argo-cd-ui@1.0.0 + › + redoc@2.0.0-rc.64 + › + dompurify@2.3.6 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

    +

    Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.

    +

    PoC

    + 
    <![CDATA[ ><img src onerror=alert(1)> ]]>
+
    +

    Remediation

    +

    Upgrade dompurify to version 2.4.9, 3.0.11 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +
    +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/v2.12.0-rc1/ghcr.io_dexidp_dex_v2.38.0.html new file mode 100644 index 0000000000000..50882f12d1bfc --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/ghcr.io_dexidp_dex_v2.38.0.html @@ -0,0 +1,3420 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:19:16 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • ghcr.io/dexidp/dex:v2.38.0/dexidp/dex (apk)
      • +
    • ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3//usr/local/bin/gomplate (gomodules)
      • +
    • ghcr.io/dexidp/dex:v2.38.0/dexidp/dex//usr/local/bin/docker-entrypoint (gomodules)
      • +
    • ghcr.io/dexidp/dex:v2.38.0/dexidp/dex//usr/local/bin/dex (gomodules)
      • +
    +
    + +
    +
    34 known vulnerabilities
    +
    98 vulnerable dependency paths
    +
    829 dependencies
    +
    +
    +
    +
    + +
    +
    +
    +

    Allocation of Resources Without Limits or Throttling

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/net/http2 +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and golang.org/x/net/http2@v0.19.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + golang.org/x/net/http2@v0.19.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + golang.org/x/net/http2@v0.20.0 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

    +

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.

    +

    Remediation

    +

    Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Out-of-bounds Write

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and openssl/libcrypto3@3.1.4-r2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    Issue summary: The POLY1305 MAC (message authentication code) implementation + contains a bug that might corrupt the internal state of applications running + on PowerPC CPU based platforms if the CPU provides vector instructions.

    +

    Impact summary: If an attacker can influence whether the POLY1305 MAC + algorithm is used, the application state might be corrupted with various + application dependent consequences.

    +

    The POLY1305 MAC (message authentication code) implementation in OpenSSL for + PowerPC CPUs restores the contents of vector registers in a different order + than they are saved. Thus the contents of some of these vector registers + are corrupted when returning to the caller. The vulnerable code is used only + on newer PowerPC processors supporting the PowerISA 2.07 instructions.

    +

    The consequences of this kind of internal application state corruption can + be various - from no consequences, if the calling application does not + depend on the contents of non-volatile XMM registers at all, to the worst + consequences, where the attacker could get complete control of the application + process. However unless the compiler uses the vector registers for storing + pointers, the most likely consequence, if any, would be an incorrect result + of some application dependent calculations or a crash leading to a denial of + service.

    +

    The POLY1305 MAC algorithm is most frequently used as part of the + CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) + algorithm. The most common usage of this AEAD cipher is with TLS protocol + versions 1.2 and 1.3. If this cipher is enabled on the server a malicious + client can influence whether this AEAD cipher is used. This implies that + TLS server applications using OpenSSL can be potentially impacted. However + we are currently not aware of any concrete application that would be affected + by this issue therefore we consider this a Low severity security issue.

    +

    Remediation

    +

    Upgrade Alpine:3.19 openssl to version 3.1.4-r3 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-0727

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and openssl/libcrypto3@3.1.4-r2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL + to crash leading to a potential Denial of Service attack

    +

    Impact summary: Applications loading files in the PKCS12 format from untrusted + sources might terminate abruptly.

    +

    A file in PKCS12 format can contain certificates and keys and may come from an + untrusted source. The PKCS12 specification allows certain fields to be NULL, but + OpenSSL does not correctly check for this case. This can lead to a NULL pointer + dereference that results in OpenSSL crashing. If an application processes PKCS12 + files from an untrusted source using the OpenSSL APIs then that application will + be vulnerable to this issue.

    +

    OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), + PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() + and PKCS12_newpass().

    +

    We have also fixed a similar issue in SMIME_write_PKCS7(). However since this + function is related to writing data we do not consider it security significant.

    +

    The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.19 openssl to version 3.1.4-r5 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Infinite loop

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + google.golang.org/protobuf/internal/encoding/json +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and google.golang.org/protobuf/internal/encoding/json@v1.31.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + google.golang.org/protobuf/internal/encoding/json@v1.31.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + google.golang.org/protobuf/internal/encoding/json@v1.32.0 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.

    +

    Note:

    +

    This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

    +

    Remediation

    +

    Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Stack-based Buffer Overflow

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + google.golang.org/protobuf/encoding/protojson +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and google.golang.org/protobuf/encoding/protojson@v1.31.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + google.golang.org/protobuf/encoding/protojson@v1.31.0 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Stack-based Buffer Overflow when processing input that uses pathologically deep nesting.

    +

    Remediation

    +

    Upgrade google.golang.org/protobuf/encoding/protojson to version 1.32.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Infinite loop

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + google.golang.org/protobuf/encoding/protojson +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and google.golang.org/protobuf/encoding/protojson@v1.31.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + google.golang.org/protobuf/encoding/protojson@v1.31.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + google.golang.org/protobuf/encoding/protojson@v1.32.0 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.

    +

    Note:

    +

    This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

    +

    Remediation

    +

    Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/vault/sdk/helper/certutil +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/vault/sdk/helper/certutil@v0.5.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/sdk/helper/certutil@v0.5.0 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/sdk/helper/compressutil@v0.5.0 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/sdk/helper/jsonutil@v0.5.0 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/sdk/helper/pluginutil@v0.5.0 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/sdk/helper/strutil@v0.5.0 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/sdk/logical@v0.5.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/vault/api +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/vault/api@v1.6.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/vault/api@v1.6.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/serf/coordinate +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/serf/coordinate@v0.9.7 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/serf/coordinate@v0.9.7 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/dexidp/dex › /usr/local/bin/dex +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/hcl/v2 +
      • + +
    • Introduced through: + + github.com/dexidp/dex@* and github.com/hashicorp/hcl/v2@v2.13.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/ext/customdecode@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/ext/tryfunc@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/gohcl@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/hclparse@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/hclsyntax@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/hclwrite@v2.13.0 + + + +
      • +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/hashicorp/hcl/v2/json@v2.13.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/hcl +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/hcl@v1.0.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/hcl@v1.0.0 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/hcl/hcl/token@v1.0.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/golang-lru/simplelru +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/golang-lru/simplelru@v0.5.4 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/golang-lru/simplelru@v0.5.4 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-version +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-version@v1.5.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-version@v1.5.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-sockaddr +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-sockaddr@v1.0.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-sockaddr@v1.0.2 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-sockaddr/template@v1.0.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-secure-stdlib/strutil +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-secure-stdlib/parseutil +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-secure-stdlib/parseutil@v0.1.5 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-secure-stdlib/parseutil@v0.1.5 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-secure-stdlib/mlock +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-secure-stdlib/mlock@v0.1.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-secure-stdlib/mlock@v0.1.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-rootcerts +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-rootcerts@v1.0.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-rootcerts@v1.0.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-retryablehttp +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-retryablehttp@v0.7.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-retryablehttp@v0.7.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-plugin +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-plugin@v1.4.4 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-plugin@v1.4.4 + + + +
      • +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-plugin/internal/plugin@v1.4.4 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-immutable-radix +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-immutable-radix@v1.3.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-immutable-radix@v1.3.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-cleanhttp +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/go-cleanhttp@v0.5.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/go-cleanhttp@v0.5.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/errwrap +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/errwrap@v1.1.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/errwrap@v1.1.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/consul/api +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/hashicorp/consul/api@v1.13.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/hashicorp/consul/api@v1.13.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/hairyhenderson/gomplate/v3 › /usr/local/bin/gomplate +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/gosimple/slug +
      • + +
    • Introduced through: + + github.com/hairyhenderson/gomplate/v3@* and github.com/gosimple/slug@v1.12.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/hairyhenderson/gomplate/v3@* + › + github.com/gosimple/slug@v1.12.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/dexidp/dex › /usr/local/bin/dex +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/go-sql-driver/mysql +
      • + +
    • Introduced through: + + github.com/dexidp/dex@* and github.com/go-sql-driver/mysql@v1.7.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/go-sql-driver/mysql@v1.7.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Handling of Highly Compressed Data (Data Amplification)

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: ghcr.io/dexidp/dex:v2.38.0/dexidp/dex › /usr/local/bin/dex +
      • +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + github.com/go-jose/go-jose/v3 +
      • + +
    • Introduced through: + + github.com/dexidp/dex@* and github.com/go-jose/go-jose/v3@v3.0.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/dexidp/dex@* + › + github.com/go-jose/go-jose/v3@v3.0.1 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification). An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU.

    +

    Remediation

    +

    Upgrade github.com/go-jose/go-jose/v3 to version 3.0.3 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Out-of-bounds Write

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + busybox/busybox +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and busybox/busybox@1.36.1-r15 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

    +

    Remediation

    +

    Upgrade Alpine:3.19 busybox to version 1.36.1-r16 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Use After Free

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + busybox/busybox +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and busybox/busybox@1.36.1-r15 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

    +

    Remediation

    +

    Upgrade Alpine:3.19 busybox to version 1.36.1-r19 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Use After Free

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + busybox/busybox +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and busybox/busybox@1.36.1-r15 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

    +

    Remediation

    +

    Upgrade Alpine:3.19 busybox to version 1.36.1-r19 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Use After Free

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + busybox/busybox +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and busybox/busybox@1.36.1-r15 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + › + busybox/busybox@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + alpine-baselayout/alpine-baselayout@3.4.3-r2 + › + busybox/busybox-binsh@1.36.1-r15 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

    +

    Remediation

    +

    Upgrade Alpine:3.19 busybox to version 1.36.1-r17 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2023-6237

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and openssl/libcrypto3@3.1.4-r2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    Issue summary: Checking excessively long invalid RSA public keys may take + a long time.

    +

    Impact summary: Applications that use the function EVP_PKEY_public_check() + to check RSA public keys may experience long delays. Where the key that + is being checked has been obtained from an untrusted source this may lead + to a Denial of Service.

    +

    When function EVP_PKEY_public_check() is called on RSA public keys, + a computation is done to confirm that the RSA modulus, n, is composite. + For valid RSA keys, n is a product of two or more large primes and this + computation completes quickly. However, if n is an overly large prime, + then this computation would take a long time.

    +

    An application that calls EVP_PKEY_public_check() and supplies an RSA key + obtained from an untrusted source could be vulnerable to a Denial of Service + attack.

    +

    The function EVP_PKEY_public_check() is not called from other OpenSSL + functions however it is called from the OpenSSL pkey command line + application. For that reason that application is also vulnerable if used + with the '-pubin' and '-check' options on untrusted data.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.19 openssl to version 3.1.4-r4 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-2511

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and openssl/libcrypto3@3.1.4-r2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    Issue summary: Some non-default TLS server configurations can cause unbounded + memory growth when processing TLSv1.3 sessions

    +

    Impact summary: An attacker may exploit certain server configurations to trigger + unbounded memory growth that would lead to a Denial of Service

    +

    This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is + being used (but not if early_data support is also configured and the default + anti-replay protection is in use). In this case, under certain conditions, the + session cache can get into an incorrect state and it will fail to flush properly + as it fills. The session cache will continue to grow in an unbounded manner. A + malicious client could deliberately create the scenario for this failure to + force a Denial of Service. It may also happen by accident in normal operation.

    +

    This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS + clients.

    +

    The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL + 1.0.2 is also not affected by this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.19 openssl to version 3.1.4-r6 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-4603

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.19 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|ghcr.io/dexidp/dex@v2.38.0 and openssl/libcrypto3@3.1.4-r2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + › + openssl/libcrypto3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + apk-tools/apk-tools@2.14.0-r5 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    • + Introduced through: + docker-image|ghcr.io/dexidp/dex@v2.38.0 + › + busybox/ssl_client@1.36.1-r15 + › + openssl/libssl3@3.1.4-r2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. + See How to fix? for Alpine:3.19 relevant fixed versions and status.

    +

    Issue summary: Checking excessively long DSA keys or parameters may be very + slow.

    +

    Impact summary: Applications that use the functions EVP_PKEY_param_check() + or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may + experience long delays. Where the key or parameters that are being checked + have been obtained from an untrusted source this may lead to a Denial of + Service.

    +

    The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform + various checks on DSA parameters. Some of those computations take a long time + if the modulus (p parameter) is too large.

    +

    Trying to use a very large modulus is slow and OpenSSL will not allow using + public keys with a modulus which is over 10,000 bits in length for signature + verification. However the key and parameter check functions do not limit + the modulus size when performing the checks.

    +

    An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() + and supplies a key or parameters obtained from an untrusted source could be + vulnerable to a Denial of Service attack.

    +

    These functions are not called by OpenSSL itself on untrusted DSA keys so + only applications that directly call these functions may be vulnerable.

    +

    Also vulnerable are the OpenSSL pkey and pkeyparam command line applications + when using the -check option.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

    +

    Remediation

    +

    Upgrade Alpine:3.19 openssl to version 3.1.5-r0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +
    +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html new file mode 100644 index 0000000000000..97ca0e2649d09 --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -0,0 +1,890 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:19:25 am (UTC+00:00)

    +
    +
    + Scanned the following path: +
      +
    • public.ecr.aws/docker/library/haproxy:2.6.17-alpine/docker/library/haproxy (apk)
      • +
    +
    + +
    +
    3 known vulnerabilities
    +
    22 vulnerable dependency paths
    +
    18 dependencies
    +
    +
    +
    +
    +
    + + + + + + + +
    Project docker-image|public.ecr.aws/docker/library/haproxy
    Path public.ecr.aws/docker/library/haproxy:2.6.17-alpine/docker/library/haproxy
    Package Manager apk
    +
    +
    +
    +
    +

    Use After Free

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.20 +
      • +
    • + Vulnerable module: + + busybox/busybox +
      • + +
    • Introduced through: + + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine and busybox/busybox@1.36.1-r28 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/busybox@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + alpine-baselayout/alpine-baselayout@3.6.5-r0 + › + busybox/busybox-binsh@1.36.1-r28 + › + busybox/busybox@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/busybox-binsh@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + alpine-baselayout/alpine-baselayout@3.6.5-r0 + › + busybox/busybox-binsh@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + ca-certificates/ca-certificates@20240226-r0 + › + busybox/busybox-binsh@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/ssl_client@1.36.1-r28 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. + See How to fix? for Alpine:3.20 relevant fixed versions and status.

    +

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

    +

    Remediation

    +

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Use After Free

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.20 +
      • +
    • + Vulnerable module: + + busybox/busybox +
      • + +
    • Introduced through: + + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine and busybox/busybox@1.36.1-r28 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/busybox@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + alpine-baselayout/alpine-baselayout@3.6.5-r0 + › + busybox/busybox-binsh@1.36.1-r28 + › + busybox/busybox@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/busybox-binsh@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + alpine-baselayout/alpine-baselayout@3.6.5-r0 + › + busybox/busybox-binsh@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + ca-certificates/ca-certificates@20240226-r0 + › + busybox/busybox-binsh@1.36.1-r28 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/ssl_client@1.36.1-r28 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. + See How to fix? for Alpine:3.20 relevant fixed versions and status.

    +

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

    +

    Remediation

    +

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-4741

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Package Manager: alpine:3.20 +
      • +
    • + Vulnerable module: + + openssl/libcrypto3 +
      • + +
    • Introduced through: + + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine and openssl/libcrypto3@3.3.0-r2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + openssl/libcrypto3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + .haproxy-rundeps@20240524.005458 + › + openssl/libcrypto3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + apk-tools/apk-tools@2.14.4-r0 + › + openssl/libcrypto3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/ssl_client@1.36.1-r28 + › + openssl/libcrypto3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + ca-certificates/ca-certificates@20240226-r0 + › + openssl/libcrypto3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + .haproxy-rundeps@20240524.005458 + › + openssl/libssl3@3.3.0-r2 + › + openssl/libcrypto3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + openssl/libssl3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + .haproxy-rundeps@20240524.005458 + › + openssl/libssl3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + apk-tools/apk-tools@2.14.4-r0 + › + openssl/libssl3@3.3.0-r2 + + + +
      • +
    • + Introduced through: + docker-image|public.ecr.aws/docker/library/haproxy@2.6.17-alpine + › + busybox/ssl_client@1.36.1-r28 + › + openssl/libssl3@3.3.0-r2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    This vulnerability has not been analyzed by NVD yet.

    +

    Remediation

    +

    Upgrade Alpine:3.20 openssl to version 3.3.0-r3 or higher.

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +
    +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html new file mode 100644 index 0000000000000..b4ddab8db8d60 --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -0,0 +1,484 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:19:29 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • public.ecr.aws/docker/library/redis:7.0.15-alpine/docker/library/redis (apk)
      • +
    • public.ecr.aws/docker/library/redis:7.0.15-alpine/tianon/gosu//usr/local/bin/gosu (gomodules)
      • +
    +
    + +
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    +
    18 dependencies
    +
    +
    +
    +
    + +
    + No known vulnerabilities detected. +
    +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/quay.io_argoproj_argocd_v2.12.0-rc1.html b/docs/snyk/v2.12.0-rc1/quay.io_argoproj_argocd_v2.12.0-rc1.html new file mode 100644 index 0000000000000..e28730ea5e107 --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/quay.io_argoproj_argocd_v2.12.0-rc1.html @@ -0,0 +1,2988 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:19:46 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd/Dockerfile (deb)
      • +
    • quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2//usr/local/bin/argocd (gomodules)
      • +
    • quay.io/argoproj/argocd:v2.12.0-rc1//usr/local/bin/kustomize (gomodules)
      • +
    • quay.io/argoproj/argocd:v2.12.0-rc1/helm/v3//usr/local/bin/helm (gomodules)
      • +
    • quay.io/argoproj/argocd:v2.12.0-rc1/git-lfs/git-lfs//usr/bin/git-lfs (gomodules)
      • +
    +
    + +
    +
    21 known vulnerabilities
    +
    98 vulnerable dependency paths
    +
    2290 dependencies
    +
    +
    +
    +
    + +
    +
    +
    +

    CVE-2020-22916

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + xz-utils/liblzma5 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and xz-utils/liblzma5@5.6.1+really5.4.5-1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + xz-utils/liblzma5@5.6.1+really5.4.5-1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + apt@2.7.14build2 + › + apt/libapt-pkg6.0t64@2.7.14build2 + › + xz-utils/liblzma5@5.6.1+really5.4.5-1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + dash@0.5.12-6ubuntu5 + › + dpkg@1.22.6ubuntu6 + › + xz-utils/liblzma5@5.6.1+really5.4.5-1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + apt@2.7.14build2 + › + adduser@3.137ubuntu1 + › + shadow/passwd@1:4.13+dfsg1-4ubuntu3 + › + pam/libpam-modules@1.5.3-5ubuntu5.1 + › + systemd/libsystemd0@255.4-1ubuntu8.1 + › + xz-utils/liblzma5@5.6.1+really5.4.5-1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream xz-utils package and not the xz-utils package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 xz-utils.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Information Exposure

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + libgcrypt20 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and libgcrypt20@1.10.3-2build1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/dirmngr@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg-agent@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + apt@2.7.14build2 + › + apt/libapt-pkg6.0t64@2.7.14build2 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + apt@2.7.14build2 + › + gnupg2/gpgv@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + apt@2.7.14build2 + › + adduser@3.137ubuntu1 + › + shadow/passwd@1:4.13+dfsg1-4ubuntu3 + › + pam/libpam-modules@1.5.3-5ubuntu5.1 + › + systemd/libsystemd0@255.4-1ubuntu8.1 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-26462

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + krb5/libk5crypto3 +
      • + +
    • Introduced through: + + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1, git@1:2.43.0-1ubuntu7.1 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssh/openssh-client@1:9.6p1-3ubuntu13 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + libssh/libssh-4@0.10.6-2build2 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + krb5/krb5-locales@1.20.1-6ubuntu2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 krb5.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    LGPL-3.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2 › /usr/local/bin/argocd +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + gopkg.in/retry.v1 +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and gopkg.in/retry.v1@v1.0.3 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + gopkg.in/retry.v1@v1.0.3 + + + +
      • +
    + +
    + +
    + +

    LGPL-3.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2 › /usr/local/bin/argocd +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/r3labs/diff +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and github.com/r3labs/diff@v1.1.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + github.com/r3labs/diff@v1.1.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2 › /usr/local/bin/argocd +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-version +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-version@v1.6.0 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + github.com/hashicorp/go-version@v1.6.0 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2 › /usr/local/bin/argocd +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-retryablehttp +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-retryablehttp@v0.7.4 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + github.com/hashicorp/go-retryablehttp@v0.7.4 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/helm/v3 › /usr/local/bin/helm +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-multierror +
      • + +
    • Introduced through: + + helm.sh/helm/v3@* and github.com/hashicorp/go-multierror@v1.1.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + helm.sh/helm/v3@* + › + github.com/hashicorp/go-multierror@v1.1.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2 › /usr/local/bin/argocd +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/hashicorp/go-cleanhttp +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-cleanhttp@v0.5.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + github.com/hashicorp/go-cleanhttp@v0.5.2 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    MPL-2.0 license

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argo-cd/v2 › /usr/local/bin/argocd +
      • +
    • + Package Manager: golang +
      • +
    • + Module: + + github.com/gosimple/slug +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and github.com/gosimple/slug@v1.13.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + github.com/gosimple/slug@v1.13.1 + + + +
      • +
    + +
    + +
    + +

    MPL-2.0 license

    + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Release of Invalid Pointer or Reference

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + patch +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and patch@2.7.6-7build3 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + patch@2.7.6-7build3 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 patch.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Double Free

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + patch +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and patch@2.7.6-7build3 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + patch@2.7.6-7build3 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 patch.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-2511

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + openssl/libssl3t64 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and openssl/libssl3t64@3.0.13-0ubuntu3.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + coreutils@9.4-3ubuntu6 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + cyrus-sasl2/libsasl2-modules@2.1.28+dfsg1-5ubuntu3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + libfido2/libfido2-1@1.14.0-1build3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssh/openssh-client@1:9.6p1-3ubuntu13 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + ca-certificates@20240203 + › + openssl@3.0.13-0ubuntu3.1 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + libssh/libssh-4@0.10.6-2build2 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + openldap/libldap2@2.6.7+dfsg-1~exp1ubuntu8 + › + cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-5ubuntu3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssl@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + ca-certificates@20240203 + › + openssl@3.0.13-0ubuntu3.1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    Issue summary: Some non-default TLS server configurations can cause unbounded + memory growth when processing TLSv1.3 sessions

    +

    Impact summary: An attacker may exploit certain server configurations to trigger + unbounded memory growth that would lead to a Denial of Service

    +

    This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is + being used (but not if early_data support is also configured and the default + anti-replay protection is in use). In this case, under certain conditions, the + session cache can get into an incorrect state and it will fail to flush properly + as it fills. The session cache will continue to grow in an unbounded manner. A + malicious client could deliberately create the scenario for this failure to + force a Denial of Service. It may also happen by accident in normal operation.

    +

    This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS + clients.

    +

    The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL + 1.0.2 is also not affected by this issue.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 openssl.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-4603

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + openssl/libssl3t64 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and openssl/libssl3t64@3.0.13-0ubuntu3.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + coreutils@9.4-3ubuntu6 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + cyrus-sasl2/libsasl2-modules@2.1.28+dfsg1-5ubuntu3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + libfido2/libfido2-1@1.14.0-1build3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssh/openssh-client@1:9.6p1-3ubuntu13 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + ca-certificates@20240203 + › + openssl@3.0.13-0ubuntu3.1 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + libssh/libssh-4@0.10.6-2build2 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + openldap/libldap2@2.6.7+dfsg-1~exp1ubuntu8 + › + cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-5ubuntu3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssl@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + ca-certificates@20240203 + › + openssl@3.0.13-0ubuntu3.1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    Issue summary: Checking excessively long DSA keys or parameters may be very + slow.

    +

    Impact summary: Applications that use the functions EVP_PKEY_param_check() + or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may + experience long delays. Where the key or parameters that are being checked + have been obtained from an untrusted source this may lead to a Denial of + Service.

    +

    The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform + various checks on DSA parameters. Some of those computations take a long time + if the modulus (p parameter) is too large.

    +

    Trying to use a very large modulus is slow and OpenSSL will not allow using + public keys with a modulus which is over 10,000 bits in length for signature + verification. However the key and parameter check functions do not limit + the modulus size when performing the checks.

    +

    An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() + and supplies a key or parameters obtained from an untrusted source could be + vulnerable to a Denial of Service attack.

    +

    These functions are not called by OpenSSL itself on untrusted DSA keys so + only applications that directly call these functions may be vulnerable.

    +

    Also vulnerable are the OpenSSL pkey and pkeyparam command line applications + when using the -check option.

    +

    The OpenSSL SSL/TLS implementation is not affected by this issue.

    +

    The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 openssl.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-4741

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + openssl/libssl3t64 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and openssl/libssl3t64@3.0.13-0ubuntu3.1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + coreutils@9.4-3ubuntu6 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + cyrus-sasl2/libsasl2-modules@2.1.28+dfsg1-5ubuntu3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + libfido2/libfido2-1@1.14.0-1build3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssh/openssh-client@1:9.6p1-3ubuntu13 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + ca-certificates@20240203 + › + openssl@3.0.13-0ubuntu3.1 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + libssh/libssh-4@0.10.6-2build2 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + openldap/libldap2@2.6.7+dfsg-1~exp1ubuntu8 + › + cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-5ubuntu3 + › + openssl/libssl3t64@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssl@3.0.13-0ubuntu3.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + ca-certificates@20240203 + › + openssl@3.0.13-0ubuntu3.1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    This vulnerability has not been analyzed by NVD yet.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 openssl.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-26458

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + krb5/libk5crypto3 +
      • + +
    • Introduced through: + + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1, git@1:2.43.0-1ubuntu7.1 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssh/openssh-client@1:9.6p1-3ubuntu13 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + libssh/libssh-4@0.10.6-2build2 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + krb5/krb5-locales@1.20.1-6ubuntu2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 krb5.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    CVE-2024-26461

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + krb5/libk5crypto3 +
      • + +
    • Introduced through: + + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1, git@1:2.43.0-1ubuntu7.1 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + › + krb5/libk5crypto3@1.20.1-6ubuntu2 + › + krb5/libkrb5support0@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + › + krb5/libkrb5-3@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + openssh/openssh-client@1:9.6p1-3ubuntu13 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + curl/libcurl3t64-gnutls@8.5.0-2ubuntu10.1 + › + libssh/libssh-4@0.10.6-2build2 + › + krb5/libgssapi-krb5-2@1.20.1-6ubuntu2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + krb5/krb5-locales@1.20.1-6ubuntu2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 krb5.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Out-of-bounds Write

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + gnupg2/gpgv +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and gnupg2/gpgv@2.4.4-2ubuntu17 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpgv@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + apt@2.7.14build2 + › + gnupg2/gpgv@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/dirmngr@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg-agent@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/dirmngr@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg@2.4.4-2ubuntu17 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + gnupg2/gpg-agent@2.4.4-2ubuntu17 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 gnupg2.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Allocation of Resources Without Limits or Throttling

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + glibc/libc-bin +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and glibc/libc-bin@2.39-0ubuntu8.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + glibc/libc-bin@2.39-0ubuntu8.2 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + glibc/libc6@2.39-0ubuntu8.2 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 glibc.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Input Validation

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + git/git-man +
      • + +
    • Introduced through: + + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1, git@1:2.43.0-1ubuntu7.1 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + › + git/git-man@1:2.43.0-1ubuntu7.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git@1:2.43.0-1ubuntu7.1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + git-lfs@3.4.1-1 + › + git@1:2.43.0-1ubuntu7.1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 git.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Input Validation

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.0-rc1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + coreutils +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 and coreutils@9.4-3ubuntu6 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.0-rc1 + › + coreutils@9.4-3ubuntu6 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 coreutils.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +
    +
    + + + diff --git a/docs/snyk/v2.12.0-rc1/redis_7.0.15-alpine.html b/docs/snyk/v2.12.0-rc1/redis_7.0.15-alpine.html new file mode 100644 index 0000000000000..3dad2fb27ab93 --- /dev/null +++ b/docs/snyk/v2.12.0-rc1/redis_7.0.15-alpine.html @@ -0,0 +1,484 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    June 23rd 2024, 12:19:50 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • redis:7.0.15-alpine (apk)
      • +
    • redis:7.0.15-alpine/tianon/gosu//usr/local/bin/gosu (gomodules)
      • +
    +
    + +
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    +
    18 dependencies
    +
    +
    +
    +
    + +
    + No known vulnerabilities detected. +
    +
    + + + diff --git a/docs/snyk/v2.9.17/argocd-iac-install.html b/docs/snyk/v2.9.17/argocd-iac-install.html index 7c7157d625886..dc95a13c77960 100644 --- a/docs/snyk/v2.9.17/argocd-iac-install.html +++ b/docs/snyk/v2.9.17/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:24:44 am (UTC+00:00)

    +

    June 23rd 2024, 12:28:46 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.9.17/argocd-iac-namespace-install.html b/docs/snyk/v2.9.17/argocd-iac-namespace-install.html index e07f677ceb5da..b1d8872ea7d4f 100644 --- a/docs/snyk/v2.9.17/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.9.17/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:24:52 am (UTC+00:00)

    +

    June 23rd 2024, 12:29:01 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.9.17/argocd-test.html b/docs/snyk/v2.9.17/argocd-test.html index a9fd4cf5773f8..cfff98c9013a2 100644 --- a/docs/snyk/v2.9.17/argocd-test.html +++ b/docs/snyk/v2.9.17/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:22:56 am (UTC+00:00)

    +

    June 23rd 2024, 12:26:31 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.9.17/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.9.17/ghcr.io_dexidp_dex_v2.37.0.html index 39dd138e3930d..c747f7a09cff5 100644 --- a/docs/snyk/v2.9.17/ghcr.io_dexidp_dex_v2.37.0.html +++ b/docs/snyk/v2.9.17/ghcr.io_dexidp_dex_v2.37.0.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:23:03 am (UTC+00:00)

    +

    June 23rd 2024, 12:26:37 am (UTC+00:00)

    Scanned the following paths: @@ -1722,6 +1722,7 @@

    References

  • https://security.netapp.com/advisory/ntap-20231027-0008/
  • http://www.openwall.com/lists/oss-security/2023/11/06/2
  • https://security.gentoo.org/glsa/202402-08
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0006/
    • @@ -5188,6 +5189,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.9.17/haproxy_2.6.14-alpine.html b/docs/snyk/v2.9.17/haproxy_2.6.14-alpine.html index 052909ea91cb3..ec4f6397050ff 100644 --- a/docs/snyk/v2.9.17/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.9.17/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:23:06 am (UTC+00:00)

    +

    June 23rd 2024, 12:26:53 am (UTC+00:00)

    Scanned the following path: @@ -2182,6 +2182,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.9.17/quay.io_argoproj_argocd_v2.9.17.html b/docs/snyk/v2.9.17/quay.io_argoproj_argocd_v2.9.17.html index fd7178f489899..914e0cc9d173a 100644 --- a/docs/snyk/v2.9.17/quay.io_argoproj_argocd_v2.9.17.html +++ b/docs/snyk/v2.9.17/quay.io_argoproj_argocd_v2.9.17.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:23:24 am (UTC+00:00)

    +

    June 23rd 2024, 12:27:19 am (UTC+00:00)

    Scanned the following paths: @@ -2658,6 +2658,7 @@

    References

  • https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740
  • https://www.openssl.org/news/secadv/20240516.txt
  • http://www.openwall.com/lists/oss-security/2024/05/16/2
    • +
  • https://security.netapp.com/advisory/ntap-20240621-0001/
    • diff --git a/docs/snyk/v2.9.17/redis_7.0.15-alpine.html b/docs/snyk/v2.9.17/redis_7.0.15-alpine.html index 09de90da5f9fc..3e6b23727c964 100644 --- a/docs/snyk/v2.9.17/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.9.17/redis_7.0.15-alpine.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    June 16th 2024, 12:23:28 am (UTC+00:00)

    +

    June 23rd 2024, 12:27:23 am (UTC+00:00)

    Scanned the following paths: @@ -467,8 +467,8 @@

    Snyk test report

    -
    3 known vulnerabilities
    -
    19 vulnerable dependency paths
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    18 dependencies
    @@ -476,372 +476,7 @@

    Snyk test report

    -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Use After Free

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - busybox/busybox -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and busybox/busybox@1.36.1-r28 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - › - busybox/busybox@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - alpine-baselayout/alpine-baselayout@3.6.5-r0 - › - busybox/busybox-binsh@1.36.1-r28 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. - See How to fix? for Alpine:3.20 relevant fixed versions and status.

    -

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

    -

    Remediation

    -

    Upgrade Alpine:3.20 busybox to version 1.36.1-r29 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    CVE-2024-4741

    -
    - -
    - low severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.20 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|redis@7.0.15-alpine and openssl/libcrypto3@3.3.0-r2 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - › - openssl/libcrypto3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - .redis-rundeps@20240524.005525 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - apk-tools/apk-tools@2.14.4-r0 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    • - Introduced through: - docker-image|redis@7.0.15-alpine - › - busybox/ssl_client@1.36.1-r28 - › - openssl/libssl3@3.3.0-r2 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    This vulnerability has not been analyzed by NVD yet.

    -

    Remediation

    -

    Upgrade Alpine:3.20 openssl to version 3.3.0-r3 or higher.

    - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    + No known vulnerabilities detected.
    From 6b433e3bd13e2ce870886d173a79199ab7b43318 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 19:17:03 +0300 Subject: [PATCH 19/23] chore(deps): bump library/golang from `c2010b9` to `a66eda6` (#18789) Bumps library/golang from `c2010b9` to `a66eda6`. --- updated-dependencies: - dependency-name: library/golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index b6ad75c6e0c37..5cf5c4c766bcc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:24.04@sha256:3f85b7caad41a95462cf5b787d8 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image # Also used as the image in CI jobs so needs all dependencies #################################################################################################### -FROM docker.io/library/golang:1.22.4@sha256:c2010b9c2342431a24a2e64e33d9eb2e484af49e72c820e200d332d214d5e61f AS builder +FROM docker.io/library/golang:1.22.4@sha256:a66eda637829ce891e9cf61ff1ee0edf544e1f6c5b0e666c7310dce231a66f28 AS builder RUN echo 'deb http://archive.debian.org/debian buster-backports main' >> /etc/apt/sources.list @@ -101,7 +101,7 @@ RUN HOST_ARCH=$TARGETARCH NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OP #################################################################################################### # Argo CD Build stage which performs the actual build of Argo CD binaries #################################################################################################### -FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.22.4@sha256:c2010b9c2342431a24a2e64e33d9eb2e484af49e72c820e200d332d214d5e61f AS argocd-build +FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.22.4@sha256:a66eda637829ce891e9cf61ff1ee0edf544e1f6c5b0e666c7310dce231a66f28 AS argocd-build WORKDIR /go/src/github.com/argoproj/argo-cd From a5805416df201ca726232f135be4ba9f2d8fd1a9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 19:17:28 +0300 Subject: [PATCH 20/23] chore(deps): bump library/golang in /test/container (#18787) Bumps library/golang from `c2010b9` to `a66eda6`. --- updated-dependencies: - dependency-name: library/golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- test/container/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/container/Dockerfile b/test/container/Dockerfile index bcacb28dcfa8d..c4ed5849409c4 100644 --- a/test/container/Dockerfile +++ b/test/container/Dockerfile @@ -8,7 +8,7 @@ RUN ln -s /usr/lib/$(uname -m)-linux-gnu /usr/lib/linux-gnu # Please make sure to also check the contained yarn version and update the references below when upgrading this image's version FROM docker.io/library/node:22.3.0@sha256:5e4044ff6001d06e7748e35bfa4f80c73cf5f5a7360a1b782995e038a01b0585 as node -FROM docker.io/library/golang:1.22.4@sha256:c2010b9c2342431a24a2e64e33d9eb2e484af49e72c820e200d332d214d5e61f as golang +FROM docker.io/library/golang:1.22.4@sha256:a66eda637829ce891e9cf61ff1ee0edf544e1f6c5b0e666c7310dce231a66f28 as golang FROM docker.io/library/registry:2.8@sha256:4fac7a8257b1d7a86599043fcc181dfbdf9c8f57e337db763ac94b0e67c6cfb5 as registry From 03acafef1cea3cdb50a5c10f78ead9cb60fac73b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 19:17:48 +0300 Subject: [PATCH 21/23] chore(deps): bump library/node in /test/container (#18786) Bumps library/node from `5e4044f` to `b98ec1c`. --- updated-dependencies: - dependency-name: library/node dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- test/container/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/container/Dockerfile b/test/container/Dockerfile index c4ed5849409c4..ebf52b7549494 100644 --- a/test/container/Dockerfile +++ b/test/container/Dockerfile @@ -6,7 +6,7 @@ FROM docker.io/library/redis:7.2.5@sha256:e422889e156ebea83856b6ff973bfe0c86bce8 RUN ln -s /usr/lib/$(uname -m)-linux-gnu /usr/lib/linux-gnu # Please make sure to also check the contained yarn version and update the references below when upgrading this image's version -FROM docker.io/library/node:22.3.0@sha256:5e4044ff6001d06e7748e35bfa4f80c73cf5f5a7360a1b782995e038a01b0585 as node +FROM docker.io/library/node:22.3.0@sha256:b98ec1c96103fbe1a9e449b3854bbc0a0ed1c5936882ae0939d4c3a771265b4b as node FROM docker.io/library/golang:1.22.4@sha256:a66eda637829ce891e9cf61ff1ee0edf544e1f6c5b0e666c7310dce231a66f28 as golang From 73984bdcab220530525039e3dd34cea7eec76b69 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 19:18:06 +0300 Subject: [PATCH 22/23] chore(deps): bump chromedriver from 126.0.2 to 126.0.3 in /ui-test (#18785) Bumps [chromedriver](https://github.com/giggio/node-chromedriver) from 126.0.2 to 126.0.3. - [Commits](https://github.com/giggio/node-chromedriver/compare/126.0.2...126.0.3) --- updated-dependencies: - dependency-name: chromedriver dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- ui-test/package.json | 2 +- ui-test/yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ui-test/package.json b/ui-test/package.json index 29a915c1c41b7..3a1ede8f7cc67 100644 --- a/ui-test/package.json +++ b/ui-test/package.json @@ -14,7 +14,7 @@ "dependencies": { "@types/selenium-webdriver": "^4.1.23", "assert": "^2.1.0", - "chromedriver": "^126.0.2", + "chromedriver": "^126.0.3", "selenium-webdriver": "^4.21.0" }, "devDependencies": { diff --git a/ui-test/yarn.lock b/ui-test/yarn.lock index a4c86582f09c3..2581cf1ff8735 100644 --- a/ui-test/yarn.lock +++ b/ui-test/yarn.lock @@ -262,10 +262,10 @@ chokidar@3.5.3: optionalDependencies: fsevents "~2.3.2" -chromedriver@^126.0.2: - version "126.0.2" - resolved "https://registry.yarnpkg.com/chromedriver/-/chromedriver-126.0.2.tgz#0c0840cd1ba00b73fa16d4292fa739860ee20ec8" - integrity sha512-61R0w7C+uJVCykabdqWsvitne2rg3MTI8xOKJosk+YbKdyLeGHYiCCeU82ZsUY+v9qnN1p48THcthgKubxPRWQ== +chromedriver@^126.0.3: + version "126.0.3" + resolved "https://registry.yarnpkg.com/chromedriver/-/chromedriver-126.0.3.tgz#5c1c8f586b0832f00286391218a56460b2d605c5" + integrity sha512-4o+ZK8926/8lqIlnnvcljCHV88Z8IguEMB5PInOiS9/Lb6cyeZSj2Uvz+ky1Jgyw2Bn7qCLJFfbUslaWnvUUbg== dependencies: "@testim/chrome-version" "^1.1.4" axios "^1.6.7" From 56c12db3891efb18032804f2ba619e2e839f3a1f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 19:18:19 +0300 Subject: [PATCH 23/23] chore(deps-dev): bump @types/node from 20.14.7 to 20.14.8 in /ui-test (#18784) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.14.7 to 20.14.8. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- ui-test/package.json | 2 +- ui-test/yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ui-test/package.json b/ui-test/package.json index 3a1ede8f7cc67..ab0f04aad769f 100644 --- a/ui-test/package.json +++ b/ui-test/package.json @@ -19,7 +19,7 @@ }, "devDependencies": { "@types/mocha": "^10.0.6", - "@types/node": "^20.14.7", + "@types/node": "^20.14.8", "dotenv": "^16.4.5", "mocha": "^10.4.0", "prettier": "^2.8.8", diff --git a/ui-test/yarn.lock b/ui-test/yarn.lock index 2581cf1ff8735..afefb6fa9f362 100644 --- a/ui-test/yarn.lock +++ b/ui-test/yarn.lock @@ -38,10 +38,10 @@ resolved "https://registry.yarnpkg.com/@types/mocha/-/mocha-10.0.6.tgz#818551d39113081048bdddbef96701b4e8bb9d1b" integrity sha512-dJvrYWxP/UcXm36Qn36fxhUKu8A/xMRXVT2cliFF1Z7UA9liG5Psj3ezNSZw+5puH2czDXRLcXQxf8JbJt0ejg== -"@types/node@*", "@types/node@^20.14.7": - version "20.14.7" - resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.7.tgz#342cada27f97509eb8eb2dbc003edf21ce8ab5a8" - integrity sha512-uTr2m2IbJJucF3KUxgnGOZvYbN0QgkGyWxG6973HCpMYFy2KfcgYuIwkJQMQkt1VbBMlvWRbpshFTLxnxCZjKQ== +"@types/node@*", "@types/node@^20.14.8": + version "20.14.8" + resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.8.tgz#45c26a2a5de26c3534a9504530ddb3b27ce031ac" + integrity sha512-DO+2/jZinXfROG7j7WKFn/3C6nFwxy2lLpgLjEXJz+0XKphZlTLJ14mo8Vfg8X5BWN6XjyESXq+LcYdT7tR3bA== dependencies: undici-types "~5.26.4"