CVE-2023-46402

[BKirov]

what about this GHSA-3f2q-6294-fmq5
The library github.com/whilp/git-urls version 0.0.0-20191001220047-6db9661140c0 was detected in Golang binary located at /shared/argocd-dex and is vulnerable to CVE-2023-46402, which exists in versions <= 1.0.1. ,
The problem here is that the latest version of this repo is https://github.com/whilp/git-urls 1.0.0
So is there any option we can workaround this ?

[crenshaw-dev]

I think I'd be in favor of switching to Chainguard's fork: https://github.com/chainguard-dev/git-urls

[BKirov]

Can you please ?

[crenshaw-dev]

Would you mind opening a PR making the switch?

[BKirov]

bkirov@XXXXX0AZQ6LX argo-cd % git push --set-upstream origin fix-git-urls
remote: Permission to argoproj/argo-cd.git denied to BKirov.
fatal: unable to access 'https://github.com/argoproj/argo-cd.git/': The requested URL returned error: 403

[crenshaw-dev]

You'll need to fork, push the branch to your fork, and then open a PR from that fork.

[BKirov]

Hi @crenshaw-dev here is the PR #17715