argoproj / argo-cd

Declarative Continuous Deployment for Kubernetes
https://argo-cd.readthedocs.io
Apache License 2.0
17.82k stars 5.44k forks source link

Critical CVE in docker library dependency in v2.12.3 #20026

Open toffiebotha opened 1 month ago

toffiebotha commented 1 month ago

Checklist:

Describe the bug

Using Azure Defender or docker scout image scanners reports the following critical vulnerability.

CVE ID SEVERITY VULNERABLE PACKAGE NAME INSTALLED VERSION FIXED IN VERSION
CVE-2024-41110 Critical github.com/docker/docker 25.0.5.0 25.0.6

To Reproduce

Using any dependency or SBOM scanner should be able to identify the vulnerable version of the dependency.

Expected behavior

Update dependency to the new version where vulnerability has been fixed.

Version

v2.12.3
pdefreitas commented 1 month ago

Version v2.12.4 is affected too.