cloud-sql-proxy.advisories.yaml

schema-version: 2.0.2

package:
  name: cloud-sql-proxy

advisories:
  - id: CGA-5cwj-c5vg-7prf
    aliases:
      - CVE-2023-45284
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:24:25Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-5mr3-r8qq-vgg5
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T18:08:42Z
        type: fixed
        data:
          fixed-version: 2.11.3-r1

  - id: CGA-c662-3p6j-6q9v
    aliases:
      - GHSA-xr7q-jx4m-x55m
    events:
      - timestamp: 2024-07-10T08:41:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cloud-sql-proxy
            componentID: ac4fb71912cd4a17
            componentName: google.golang.org/grpc
            componentVersion: v1.64.0
            componentType: go-module
            componentLocation: /usr/bin/cloud-sql-proxy
            scanner: grype
      - timestamp: 2024-07-10T11:10:38Z
        type: fixed
        data:
          fixed-version: 2.11.4-r2

  - id: CGA-f83w-x85v-6v43
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-13T07:05:40Z
        type: fixed
        data:
          fixed-version: 2.10.1-r1

  - id: CGA-mc9r-gxf4-3wq9
    aliases:
      - CVE-2024-24783
      - GHSA-3q2c-pvp5-3cqp
    events:
      - timestamp: 2024-03-13T07:07:42Z
        type: fixed
        data:
          fixed-version: 2.9.0-r1

  - id: CGA-p45q-qffm-3ph3
    aliases:
      - CVE-2023-3978
      - GHSA-2wrh-6pvc-2jm9
    events:
      - timestamp: 2023-10-13T16:46:48Z
        type: fixed
        data:
          fixed-version: 2.7.0-r1

  - id: CGA-pc8p-977v-8r27
    aliases:
      - CVE-2019-3826
      - GHSA-3m87-5598-2v4f
    events:
      - timestamp: 2023-12-17T17:35:41Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: This vulnerability has been fixed in version v2.7.1 which corresponds to the Go library version v0.7.1 and this package includes a later version.

  - id: CGA-pcfg-c64m-9rp4
    aliases:
      - CVE-2024-24784
      - GHSA-fgq5-q76c-gx78
    events:
      - timestamp: 2024-03-13T07:07:38Z
        type: fixed
        data:
          fixed-version: 2.9.0-r1

  - id: CGA-pcr6-2v2q-3r6j
    aliases:
      - CVE-2023-45289
      - GHSA-32ch-6x54-q4h9
    events:
      - timestamp: 2024-03-13T07:07:40Z
        type: fixed
        data:
          fixed-version: 2.9.0-r1

  - id: CGA-q3c2-mq6j-2fhj
    aliases:
      - CVE-2023-39325
      - GHSA-4374-p667-p6c8
    events:
      - timestamp: 2023-10-13T16:45:01Z
        type: fixed
        data:
          fixed-version: 2.7.0-r1

  - id: CGA-vcf3-x373-xvwj
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2024-07-04T08:07:33Z
        type: fixed
        data:
          fixed-version: 2.11.4-r1

  - id: CGA-vj9q-x5h3-534x
    aliases:
      - CVE-2023-45290
      - GHSA-rr6r-cfgf-gc6h
    events:
      - timestamp: 2024-03-13T07:07:41Z
        type: fixed
        data:
          fixed-version: 2.9.0-r1

  - id: CGA-vmmf-c34j-5cv3
    aliases:
      - CVE-2023-48795
      - GHSA-45x7-px36-x8w8
    events:
      - timestamp: 2023-12-19T17:56:47Z
        type: fixed
        data:
          fixed-version: 2.8.1-r2

  - id: CGA-vpf2-x849-f2pw
    aliases:
      - CVE-2024-24785
      - GHSA-j6m3-gc37-6r6q
    events:
      - timestamp: 2024-03-13T07:07:39Z
        type: fixed
        data:
          fixed-version: 2.9.0-r1

  - id: CGA-wj4m-65rm-6gcj
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T18:08:39Z
        type: fixed
        data:
          fixed-version: 2.11.3-r1

  - id: CGA-wj63-3phj-cc6x
    aliases:
      - CVE-2023-45283
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:24:23Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-wqpx-chm9-5vx9
    aliases:
      - CVE-2024-24786
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:05:04Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cloud-sql-proxy
            componentID: 74e37fb2f42fd26e
            componentName: google.golang.org/protobuf
            componentVersion: v1.32.0
            componentType: go-module
            componentLocation: /usr/bin/cloud-sql-proxy
            scanner: grype
      - timestamp: 2024-03-14T21:35:31Z
        type: fixed
        data:
          fixed-version: 2.10.0-r0