atlantis.advisories.yaml

schema-version: 2.0.2

package:
  name: atlantis

advisories:
  - id: CGA-2q6f-cm6g-w3f3
    aliases:
      - CVE-2023-48795
      - GHSA-45x7-px36-x8w8
    events:
      - timestamp: 2023-12-19T10:16:12Z
        type: fixed
        data:
          fixed-version: 0.27.0-r3

  - id: CGA-4f34-8mc3-3cwj
    aliases:
      - CVE-2024-24787
      - GHSA-5fq7-4mxc-535h
    events:
      - timestamp: 2024-05-14T10:03:18Z
        type: fixed
        data:
          fixed-version: 0.27.3-r1

  - id: CGA-4j9q-52f5-f8r4
    aliases:
      - CVE-2022-24912
      - GHSA-jxqv-jcvh-7gr4
    events:
      - timestamp: 2024-04-26T01:00:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: atlantis
            componentID: 07b3a75bc99d65d0
            componentName: github.com/runatlantis/atlantis
            componentVersion: v0.0.0-20240425021020-565fd9d08832
            componentType: go-module
            componentLocation: /usr/bin/atlantis
            scanner: grype
      - timestamp: 2024-05-04T17:00:50Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'Module "github.com/runatlantis/atlantis" at "/usr/bin/atlantis": the commit of the fixed version (700cffd57ddc12c456e1094f5a60f7d61c86c4db) is an ancestor of installed commit (565fd9d0883285511fa3175c4657d55f9215dc00), which means the installed version was misidentified by the scanner and the vulnerability has actually been fixed.'

  - id: CGA-6rqp-fc25-fh2h
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T13:13:28Z
        type: fixed
        data:
          fixed-version: 0.28.1-r1

  - id: CGA-6v26-8q96-376f
    aliases:
      - CVE-2023-44487
      - GHSA-qppj-fm5r-hxr3
    events:
      - timestamp: 2023-10-19T18:29:42Z
        type: fixed
        data:
          fixed-version: 0.26.0-r3

  - id: CGA-938x-8r9h-7wq2
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-13T07:06:09Z
        type: fixed
        data:
          fixed-version: 0.27.2-r2

  - id: CGA-c3jx-wj9g-2792
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2024-07-04T10:11:04Z
        type: fixed
        data:
          fixed-version: 0.28.3-r1

  - id: CGA-c6f9-cc8x-vx3p
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T13:13:26Z
        type: fixed
        data:
          fixed-version: 0.28.1-r1

  - id: CGA-g9pr-w52j-9jrx
    aliases:
      - CVE-2024-24788
      - GHSA-2jwv-jmq4-4j3r
    events:
      - timestamp: 2024-05-14T10:03:19Z
        type: fixed
        data:
          fixed-version: 0.27.3-r1

  - id: CGA-hx53-v6c7-qv87
    aliases:
      - CVE-2023-39325
      - GHSA-4374-p667-p6c8
    events:
      - timestamp: 2023-10-19T18:28:26Z
        type: fixed
        data:
          fixed-version: 0.26.0-r3

  - id: CGA-hx8r-rvc5-hrcc
    aliases:
      - CVE-2023-45284
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:23:16Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-phm8-6j62-7r5x
    aliases:
      - CVE-2023-45283
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:23:14Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-v225-cpcj-q5rr
    aliases:
      - CVE-2024-24786
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:16:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: atlantis
            componentID: 5015b8bcde67212c
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/bin/atlantis
            scanner: grype
      - timestamp: 2024-03-14T15:19:08Z
        type: fixed
        data:
          fixed-version: 0.27.2-r1