berg.advisories.yaml

schema-version: 2.0.2

package:
  name: berg

advisories:
  - id: CGA-3qgw-phcc-2fh2
    aliases:
      - CVE-2020-26235
      - GHSA-wcg3-cvx6-7396
    events:
      - timestamp: 2024-07-29T10:01:43Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: 19db6cb64135a1cc
            componentName: time
            componentVersion: 0.1.45
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:17:39Z
        type: pending-upstream-fix
        data:
          note: |
            Remediating this vulnerability requires upgrading 'time' to 0.2.23 or later.
            Unfortunately, we are not able to upgrade this dependency, without build compilation issues.
            Specifically, the 'chrono' dependency expects an older version of time.
            Pending fix from upstream.

  - id: CGA-6399-mq66-q9qw
    aliases:
      - CVE-2024-27308
      - GHSA-r8w9-5wcg-vfj7
    events:
      - timestamp: 2024-07-29T10:01:42Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: d41baace707d138b
            componentName: mio
            componentVersion: 0.8.6
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:26Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2

  - id: CGA-7fxq-h3g4-vjvf
    aliases:
      - GHSA-q6cp-qfwq-4gcv
    events:
      - timestamp: 2024-07-29T10:01:41Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: 989721efc542bf4e
            componentName: h2
            componentVersion: 0.3.19
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:25Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2

  - id: CGA-8h9x-542r-q5h9
    aliases:
      - GHSA-q445-7m23-qrmw
    events:
      - timestamp: 2024-07-29T10:01:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: 3d5c156855d3f434
            componentName: openssl
            componentVersion: 0.10.52
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:25Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2

  - id: CGA-8qwx-c6h4-w32c
    aliases:
      - GHSA-xcf7-rvmh-g6q4
    events:
      - timestamp: 2024-07-29T10:01:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: 3d5c156855d3f434
            componentName: openssl
            componentVersion: 0.10.52
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:26Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2

  - id: CGA-f4mx-xp5v-76qc
    aliases:
      - GHSA-8r5v-vm4m-4g25
    events:
      - timestamp: 2024-07-29T10:01:39Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: 989721efc542bf4e
            componentName: h2
            componentVersion: 0.3.19
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:24Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2

  - id: CGA-m7hx-2wj7-gchv
    aliases:
      - GHSA-xphf-cx8h-7q9g
    events:
      - timestamp: 2024-07-29T10:01:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: 3d5c156855d3f434
            componentName: openssl
            componentVersion: 0.10.52
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:23Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2

  - id: CGA-r8fm-xrjw-4qhq
    aliases:
      - GHSA-c827-hfw6-qwvm
    events:
      - timestamp: 2024-07-29T10:01:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: berg
            componentID: b3642eaf49fc79de
            componentName: rustix
            componentVersion: 0.37.19
            componentType: rust-crate
            componentLocation: /usr/bin/berg
            scanner: grype
      - timestamp: 2024-10-08T11:23:24Z
        type: fixed
        data:
          fixed-version: 0.3.5-r2