# Snyk test report

March 24th 2024, 12:15:25 am (UTC+00:00)

Scanned the following paths:

- /argo-cd/argoproj/argo-cd/v2/go.mod (gomodules)
- /argo-cd/ui/yarn.lock (yarn)

9 known vulnerabilities
144 vulnerable dependency paths
2037 dependencies

## LGPL-3.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: gopkg.in/retry.v1
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/Azure/kubelogin/pkg/token@0.0.20 › gopkg.in/retry.v1@1.0.3

LGPL-3.0 license

More about this vulnerability

## Infinite loop

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Vulnerable module: google.golang.org/protobuf/internal/encoding/json
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/pkg/grpc/http@#d56162821bd1 › github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/reflection@1.59.0 › google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health@1.59.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0 › google.golang.org/protobuf/internal/encoding/json@1.31.0

## Overview

Affected versions of this package are vulnerable to Infinite loop via the `protojson.Unmarshal` function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.

Note:

This condition can occur when unmarshaling into a message which contains a `google.protobuf.Any` value, or when the `UnmarshalOptions.DiscardUnknown` option is set.

## Remediation

Upgrade `google.golang.org/protobuf/internal/encoding/json` to version 1.33.0 or higher.

## References

- GitHub Commit
- GitHub Release
- Vulnerability Advisory

More about this vulnerability

## Stack-based Buffer Overflow

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Vulnerable module: google.golang.org/protobuf/encoding/protojson
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › go.opentelemetry.io/proto/otlp/collector/trace/v1@1.0.0 › github.com/grpc-ecosystem/grpc-gateway/v2/runtime@2.16.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/pkg/grpc/http@#d56162821bd1 › github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › go.opentelemetry.io/proto/otlp/collector/trace/v1@1.0.0 › github.com/grpc-ecosystem/grpc-gateway/v2/runtime@2.16.0 › google.golang.org/protobuf/types/known/structpb@1.31.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/reflection@1.59.0 › google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health@1.59.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/reflection@1.59.0 › google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health@1.59.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0

## Overview

Affected versions of this package are vulnerable to Stack-based Buffer Overflow when processing input that uses pathologically deep nesting.

## Remediation

Upgrade `google.golang.org/protobuf/encoding/protojson` to version 1.32.0 or higher.

## References

- GitHub Commit
- GitHub Issue

More about this vulnerability

## Infinite loop

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Vulnerable module: google.golang.org/protobuf/encoding/protojson
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › go.opentelemetry.io/proto/otlp/collector/trace/v1@1.0.0 › github.com/grpc-ecosystem/grpc-gateway/v2/runtime@2.16.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/pkg/grpc/http@#d56162821bd1 › github.com/grpc-ecosystem/grpc-gateway/runtime@1.16.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › go.opentelemetry.io/proto/otlp/collector/trace/v1@1.0.0 › github.com/grpc-ecosystem/grpc-gateway/v2/runtime@2.16.0 › google.golang.org/protobuf/types/known/structpb@1.31.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/auth@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/retry@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-prometheus@1.2.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.21.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/reflection@1.59.0 › google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health@1.59.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2/apierror@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/internal/gensupport@0.132.0 › github.com/googleapis/gax-go/v2@2.12.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/reflection@1.59.0 › google.golang.org/grpc/reflection/grpc_reflection_v1alpha@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › google.golang.org/grpc/health@1.59.0 › google.golang.org/grpc/health/grpc_health_v1@1.59.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags/logrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware/tags@1.4.0 › github.com/grpc-ecosystem/go-grpc-middleware@1.4.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › google.golang.org/api/chat/v1@0.132.0 › google.golang.org/api/transport/http@0.132.0 › google.golang.org/api/option@0.132.0 › google.golang.org/grpc@1.59.0 › google.golang.org/grpc/internal/transport@1.59.0 › google.golang.org/grpc/internal/pretty@1.59.0 › github.com/golang/protobuf/jsonpb@1.4.2 › google.golang.org/protobuf/encoding/protojson@1.31.0

## Overview

Affected versions of this package are vulnerable to Infinite loop via the `protojson.Unmarshal` function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.

Note:

This condition can occur when unmarshaling into a message which contains a `google.protobuf.Any` value, or when the `UnmarshalOptions.DiscardUnknown` option is set.

## Remediation

Upgrade `google.golang.org/protobuf/encoding/protojson` to version 1.33.0 or higher.

## References

- GitHub Commit
- GitHub Release
- Vulnerability Advisory

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/r3labs/diff
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 and github.com/r3labs/diff@1.1.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/r3labs/diff@1.1.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/hashicorp/go-version
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.15.1 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › code.gitea.io/sdk/gitea@0.15.1 › github.com/hashicorp/go-version@1.2.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/hashicorp/go-retryablehttp
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 and github.com/hashicorp/go-retryablehttp@0.7.4

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/xanzy/go-gitlab@0.91.1 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/hashicorp/go-cleanhttp
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/hashicorp/go-retryablehttp@0.7.4 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/xanzy/go-gitlab@0.91.1 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/xanzy/go-gitlab@0.91.1 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/subscriptions@#2daee6022f41 › github.com/argoproj/notifications-engine/pkg/services@#2daee6022f41 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/gosimple/slug
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/gosimple/slug@1.13.1

MPL-2.0 license

More about this vulnerability