actions-runner-controller.advisories.yaml

schema-version: 2.0.2

package:
  name: actions-runner-controller

advisories:
  - id: CGA-2m48-vwwr-5rx7
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T18:27:53Z
        type: fixed
        data:
          fixed-version: 0.9.2-r1

  - id: CGA-3cxp-cwgj-7xh3
    aliases:
      - GHSA-2x5j-vhc8-9cwm
    events:
      - timestamp: 2025-06-11T07:10:09Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: cd9824e4af5a7827
            componentName: github.com/cloudflare/circl
            componentVersion: v1.6.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-06-11T08:38:10Z
        type: true-positive-determination
        data:
          note: Unable to use govulncheck to triage this advisory because the vulnerability was not found in the Go vuln DB. Treating as a true positive since we can't confirm this is a false positive.
      - timestamp: 2025-06-11T08:52:07Z
        type: fixed
        data:
          fixed-version: 0.11.0-r3

  - id: CGA-3jgx-2xfx-ffh9
    aliases:
      - CVE-2025-47914
      - GHSA-f6x5-jh6r-wrfv
    events:
      - timestamp: 2025-11-21T07:52:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: d9fa8985c6915acd
            componentName: golang.org/x/crypto
            componentVersion: v0.43.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-11-21T08:56:44Z
        type: fixed
        data:
          fixed-version: 0.13.0-r1

  - id: CGA-3mv4-6w43-q4mr
    aliases:
      - CVE-2024-34155
      - GHSA-8xfx-rj4p-23jm
    events:
      - timestamp: 2024-09-10T07:03:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: c7a0b32f7640e957
            componentName: stdlib
            componentVersion: go1.22.5
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2024-09-12T19:01:37Z
        type: fixed
        data:
          fixed-version: 0.9.3-r2

  - id: CGA-47wh-cp9c-5g6j
    aliases:
      - CVE-2023-45290
      - GHSA-rr6r-cfgf-gc6h
    events:
      - timestamp: 2024-03-13T07:05:19Z
        type: fixed
        data:
          fixed-version: 0.8.3-r1

  - id: CGA-48h3-xpvr-qp2g
    aliases:
      - CVE-2025-22871
      - GHSA-g9pc-8g42-g6vq
    events:
      - timestamp: 2025-04-10T07:35:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: ea703025254b9a8b
            componentName: stdlib
            componentVersion: go1.24.1
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-04-10T12:28:29Z
        type: fixed
        data:
          fixed-version: 0.11.0-r1

  - id: CGA-4cgp-mq75-fqx5
    aliases:
      - CVE-2024-51744
      - GHSA-29wx-vh33-7x7r
    events:
      - timestamp: 2024-11-05T07:36:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 5403ac979ae85091
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2024-11-07T07:29:00Z
        type: fixed
        data:
          fixed-version: 0.9.3-r3

  - id: CGA-4fgg-48pc-jgx7
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2024-07-04T07:04:53Z
        type: fixed
        data:
          fixed-version: 0.9.3-r1

  - id: CGA-7532-27j6-77q3
    aliases:
      - CVE-2025-61729
      - GHSA-7c64-f9jr-v9h2
    events:
      - timestamp: 2025-12-04T12:56:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 5d73c29cccf9b47c
            componentName: stdlib
            componentVersion: go1.25.4
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-12-04T13:56:42Z
        type: true-positive-determination
        data:
          note: 'Govulncheck found vulnerable symbols in Go binaries at the following locations: in actions-runner-controller-0.13.0-r2.apk, at usr/bin/actions-metrics-server, usr/bin/actions-metrics-server, usr/bin/ghalistener, usr/bin/ghalistener, usr/bin/github-webhook-server, usr/bin/github-webhook-server, usr/bin/manager, usr/bin/manager.'
      - timestamp: 2025-12-04T17:35:25Z
        type: fixed
        data:
          fixed-version: 0.13.0-r3

  - id: CGA-7hh3-rfp4-w662
    aliases:
      - CVE-2024-6104
      - GHSA-v6v8-xj6m-xwqh
    events:
      - timestamp: 2024-06-25T07:05:04Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: dc432881c7046507
            componentName: github.com/hashicorp/go-retryablehttp
            componentVersion: v0.7.5
            componentType: go-module
            componentLocation: /usr/bin/ghalistener
            scanner: grype
      - timestamp: 2024-06-25T09:08:23Z
        type: fixed
        data:
          fixed-version: 0.9.2-r2

  - id: CGA-85hw-w5q3-v6gw
    aliases:
      - CVE-2023-48795
      - GHSA-45x7-px36-x8w8
    events:
      - timestamp: 2024-01-24T07:07:42Z
        type: fixed
        data:
          fixed-version: 0.8.1-r1

  - id: CGA-88r3-q8pj-rg4r
    aliases:
      - CVE-2024-45341
      - GHSA-3f6r-qh9c-x6mm
    events:
      - timestamp: 2025-01-31T07:06:11Z
        type: fixed
        data:
          fixed-version: 0.10.1-r2

  - id: CGA-89qv-69vf-6h83
    aliases:
      - CVE-2025-58181
      - GHSA-j5w8-q4qc-rx2x
    events:
      - timestamp: 2025-11-21T07:52:49Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: d9fa8985c6915acd
            componentName: golang.org/x/crypto
            componentVersion: v0.43.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-11-21T08:56:45Z
        type: fixed
        data:
          fixed-version: 0.13.0-r1

  - id: CGA-8q25-h935-vf5h
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-13T07:10:41Z
        type: fixed
        data:
          fixed-version: 0.9.0-r1

  - id: CGA-94gf-xwcf-j9j7
    aliases:
      - CVE-2023-45283
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:22:35Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-9q3j-jp56-5v2f
    aliases:
      - CVE-2024-24783
      - GHSA-3q2c-pvp5-3cqp
    events:
      - timestamp: 2024-03-13T07:05:17Z
        type: fixed
        data:
          fixed-version: 0.8.3-r1

  - id: CGA-cjf2-qf38-54vf
    aliases:
      - CVE-2024-34156
      - GHSA-crqm-pwhx-j97f
    events:
      - timestamp: 2024-09-10T07:03:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: c7a0b32f7640e957
            componentName: stdlib
            componentVersion: go1.22.5
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2024-09-12T19:01:36Z
        type: fixed
        data:
          fixed-version: 0.9.3-r2

  - id: CGA-cr49-jp4x-mm9v
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:10:49Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: c572a3fb56a58cf7
            componentName: golang.org/x/crypto
            componentVersion: v0.22.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2024-12-12T15:12:08Z
        type: fixed
        data:
          fixed-version: 0.9.3-r4

  - id: CGA-f54w-2fr9-56h8
    aliases:
      - CVE-2025-30204
      - GHSA-mh63-6h87-95cp
    events:
      - timestamp: 2025-03-22T07:13:18Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 1664651b4f5070e7
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.1
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-03-22T10:27:35Z
        type: fixed
        data:
          fixed-version: 0.10.1-r7

  - id: CGA-g678-2gjg-65j8
    aliases:
      - CVE-2024-45336
      - GHSA-7wrw-r4p8-38rx
    events:
      - timestamp: 2025-01-31T07:06:17Z
        type: fixed
        data:
          fixed-version: 0.10.1-r2

  - id: CGA-gmr7-2m3w-hrc4
    aliases:
      - CVE-2025-22866
      - GHSA-3whm-j4xm-rv8x
    events:
      - timestamp: 2025-02-08T07:02:43Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 3d81710eafbc8cfe
            componentName: stdlib
            componentVersion: go1.23.5
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-02-08T15:15:53Z
        type: fixed
        data:
          fixed-version: 0.10.1-r3

  - id: CGA-hfj6-rc7r-jjh5
    aliases:
      - CVE-2025-22868
    events:
      - timestamp: 2025-03-06T20:40:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: f1e6ba6fab0ed0a4
            componentName: golang.org/x/oauth2
            componentVersion: v0.19.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-03-13T06:37:33Z
        type: fixed
        data:
          fixed-version: 0.10.1-r5

  - id: CGA-hfv5-jf5x-vrwh
    aliases:
      - CVE-2024-24786
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:21:37Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 8bf78d89e4215f78
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/bin/manager
            scanner: grype
      - timestamp: 2024-03-14T15:21:06Z
        type: fixed
        data:
          fixed-version: 0.8.3-r2

  - id: CGA-hvq5-3g64-5ch6
    aliases:
      - CVE-2025-22869
    events:
      - timestamp: 2025-03-06T20:40:42Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 31bbb56e5d748795
            componentName: golang.org/x/crypto
            componentVersion: v0.31.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-03-12T08:35:09Z
        type: fixed
        data:
          fixed-version: 0.10.1-r4

  - id: CGA-mcx9-3mf4-37r4
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T07:07:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 69ff8abc5846c0b1
            componentName: golang.org/x/net
            componentVersion: v0.25.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2024-12-20T07:10:36Z
        type: fixed
        data:
          fixed-version: 0.10.1-r1

  - id: CGA-mrpr-xwf5-98c5
    aliases:
      - CVE-2023-45284
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:22:36Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-qfhf-fgpg-f27r
    aliases:
      - CVE-2023-45289
      - GHSA-32ch-6x54-q4h9
    events:
      - timestamp: 2024-03-13T07:05:18Z
        type: fixed
        data:
          fixed-version: 0.8.3-r1

  - id: CGA-r36x-vmgm-mxjf
    aliases:
      - CVE-2024-24784
      - GHSA-fgq5-q76c-gx78
    events:
      - timestamp: 2024-03-13T07:05:17Z
        type: fixed
        data:
          fixed-version: 0.8.3-r1

  - id: CGA-rv9f-jf65-m35x
    aliases:
      - CVE-2025-22870
      - GHSA-qxp5-gwg8-xv66
    events:
      - timestamp: 2025-03-14T00:34:38Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: 2df381ed4735e929
            componentName: golang.org/x/net
            componentVersion: v0.33.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-03-14T14:12:07Z
        type: fixed
        data:
          fixed-version: 0.10.1-r6

  - id: CGA-v99p-2g2h-jjpr
    aliases:
      - CVE-2025-22872
      - GHSA-vvgc-356p-c3xw
    events:
      - timestamp: 2025-04-17T07:06:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: c4367d95188ab3e2
            componentName: golang.org/x/net
            componentVersion: v0.37.0
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2025-04-17T08:39:24Z
        type: fixed
        data:
          fixed-version: 0.11.0-r2

  - id: CGA-vhfm-fjmr-pj52
    aliases:
      - CVE-2024-24785
      - GHSA-j6m3-gc37-6r6q
    events:
      - timestamp: 2024-03-13T07:05:19Z
        type: fixed
        data:
          fixed-version: 0.8.3-r1

  - id: CGA-wcxq-gh5q-366f
    aliases:
      - CVE-2024-34158
      - GHSA-j7vj-rw65-4v26
    events:
      - timestamp: 2024-09-10T07:03:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: actions-runner-controller
            componentID: c7a0b32f7640e957
            componentName: stdlib
            componentVersion: go1.22.5
            componentType: go-module
            componentLocation: /usr/bin/actions-metrics-server
            scanner: grype
      - timestamp: 2024-09-12T19:01:37Z
        type: fixed
        data:
          fixed-version: 0.9.3-r2

  - id: CGA-wmh8-rpp4-45r5
    aliases:
      - GHSA-9763-4f94-gfch
    events:
      - timestamp: 2024-01-24T07:07:42Z
        type: fixed
        data:
          fixed-version: 0.8.1-r1

  - id: CGA-x93h-c5h9-f86w
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T18:27:50Z
        type: fixed
        data:
          fixed-version: 0.9.2-r1