From 987615f4b0d9fe2c4088a401dcac3a20e77484d8 Mon Sep 17 00:00:00 2001 From: Yuki Nakamura Date: Sun, 9 Jul 2023 06:48:28 +0900 Subject: [PATCH 01/17] docs: fix typo (#14412) Signed-off-by: yukinakanaka --- docs/operator-manual/app-any-namespace.md | 2 +- docs/operator-manual/applicationset/Appset-Any-Namespace.md | 4 ++-- docs/operator-manual/applicationset/Generators-Plugin.md | 2 +- docs/operator-manual/high_availability.md | 2 +- docs/operator-manual/reconcile.md | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/operator-manual/app-any-namespace.md b/docs/operator-manual/app-any-namespace.md index ab4b0ca299d7b..b59b046d3746b 100644 --- a/docs/operator-manual/app-any-namespace.md +++ b/docs/operator-manual/app-any-namespace.md @@ -130,7 +130,7 @@ For backwards compatibility, if the namespace of the Application is the control ### Application RBAC -The RBAC syntax for Application objects has been changed from `/` to `//` to accomodate the need to restrict access based on the source namespace of the Application to be managed. +The RBAC syntax for Application objects has been changed from `/` to `//` to accommodate the need to restrict access based on the source namespace of the Application to be managed. For backwards compatibility, Applications in the `argocd` namespace can still be refered to as `/` in the RBAC policy rules. diff --git a/docs/operator-manual/applicationset/Appset-Any-Namespace.md b/docs/operator-manual/applicationset/Appset-Any-Namespace.md index 86f0655f6a7e4..adf694f655f13 100644 --- a/docs/operator-manual/applicationset/Appset-Any-Namespace.md +++ b/docs/operator-manual/applicationset/Appset-Any-Namespace.md @@ -111,9 +111,9 @@ For backwards compatibility, if the namespace of the ApplicationSet is the contr ### Applicationsets RBAC -The RBAC syntax for Application objects has been changed from `/` to `//` to accomodate the need to restrict access based on the source namespace of the Application to be managed. +The RBAC syntax for Application objects has been changed from `/` to `//` to accommodate the need to restrict access based on the source namespace of the Application to be managed. -For backwards compatibility, Applications in the argocd namespace can still be refered to as `/` in the RBAC policy rules. +For backwards compatibility, Applications in the argocd namespace can still be referred to as `/` in the RBAC policy rules. Wildcards do not make any distinction between project and applicationset namespaces yet. For example, the following RBAC rule would match any application belonging to project foo, regardless of the namespace it is created in: diff --git a/docs/operator-manual/applicationset/Generators-Plugin.md b/docs/operator-manual/applicationset/Generators-Plugin.md index 187ec255fc446..57ae0f90fb840 100644 --- a/docs/operator-manual/applicationset/Generators-Plugin.md +++ b/docs/operator-manual/applicationset/Generators-Plugin.md @@ -221,7 +221,7 @@ Some things to note here: ## With matrix and pull request example -In the following example, the plugin implementation is returning a set of image digests for the given branch. The returned list contains only one item correspondng to the latest builded image for the branch. +In the following example, the plugin implementation is returning a set of image digests for the given branch. The returned list contains only one item corresponding to the latest built image for the branch. ```yaml apiVersion: argoproj.io/v1alpha1 diff --git a/docs/operator-manual/high_availability.md b/docs/operator-manual/high_availability.md index 56030fa2e9a57..eaa000b5d96d5 100644 --- a/docs/operator-manual/high_availability.md +++ b/docs/operator-manual/high_availability.md @@ -83,7 +83,7 @@ spec: * The shard distribution algorithm of the `argocd-application-controller` can be set by using the `--sharding-method` parameter. Supported sharding methods are : [legacy (default), round-robin]. `legacy` mode uses an `uid` based distribution (non-uniform). `round-robin` uses an equal distribution across all shards. The `--sharding-method` parameter can also be overriden by setting the key `controller.sharding.algorithm` in the `argocd-cmd-params-cm` `configMap` (preferably) or by setting the `ARGOCD_CONTROLLER_SHARDING_ALGORITHM` environment variable and by specifiying the same possible values. !!! warning "Alpha Feature" - The `round-robin` shard distribution algorithm is an experimental feature. Reshuffling is known to occur in certain scenarios with cluster removal. If the cluster at rank-0 is removed, reshuffling all clusters across shards will occur and may temporarly have negative performance impacts. + The `round-robin` shard distribution algorithm is an experimental feature. Reshuffling is known to occur in certain scenarios with cluster removal. If the cluster at rank-0 is removed, reshuffling all clusters across shards will occur and may temporarily have negative performance impacts. * A cluster can be manually assigned and forced to a `shard` by patching the `shard` field in the cluster secret to contain the shard number, e.g. ```yaml diff --git a/docs/operator-manual/reconcile.md b/docs/operator-manual/reconcile.md index a3273c97d9922..7c886005903e2 100644 --- a/docs/operator-manual/reconcile.md +++ b/docs/operator-manual/reconcile.md @@ -1,6 +1,6 @@ # Reconcile Optimization -By default, an Argo CD Application is refreshed everytime a resource that belongs to it changes. +By default, an Argo CD Application is refreshed every time a resource that belongs to it changes. Kubernetes controllers often update the resources they watch periodically, causing continuous reconcile operation on the Application and a high CPU usage on the `argocd-application-controller`. Argo CD allows you to optionally ignore resource updates on specific fields From 918e19e27a58461d84135896480e14fdae1a6f39 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 9 Jul 2023 01:48:59 +0000 Subject: [PATCH 02/17] [Bot] docs: Update Snyk reports (#14415) Signed-off-by: CI Co-authored-by: CI --- docs/snyk/index.md | 78 +- docs/snyk/master/argocd-iac-install.html | 82 +- .../master/argocd-iac-namespace-install.html | 2 +- docs/snyk/master/argocd-test.html | 170 +- .../master/ghcr.io_dexidp_dex_v2.36.0.html | 1245 --------------- .../master/ghcr.io_dexidp_dex_v2.37.0.html | 483 ++++++ docs/snyk/master/haproxy_2.6.14-alpine.html | 2 +- .../quay.io_argoproj_argocd_latest.html | 521 +++++- docs/snyk/master/redis_7.0.11-alpine.html | 2 +- .../v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html | 1245 --------------- .../argocd-iac-install.html | 2 +- .../argocd-iac-namespace-install.html | 2 +- .../{v2.5.19 => v2.5.20}/argocd-test.html | 8 +- .../v2.5.20/ghcr.io_dexidp_dex_v2.37.0.html | 483 ++++++ .../haproxy_2.6.14-alpine.html | 2 +- .../quay.io_argoproj_argocd_v2.5.20.html} | 1397 +++++++++++++++-- .../redis_7.0.11-alpine.html | 2 +- .../v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html | 1245 --------------- .../argocd-iac-install.html | 2 +- .../argocd-iac-namespace-install.html | 2 +- .../{v2.6.11 => v2.6.12}/argocd-test.html | 10 +- .../v2.6.12/ghcr.io_dexidp_dex_v2.37.0.html | 483 ++++++ .../haproxy_2.6.14-alpine.html | 2 +- .../quay.io_argoproj_argocd_v2.6.12.html} | 711 +++++++-- .../redis_7.0.11-alpine.html | 2 +- .../v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html | 1245 --------------- .../argocd-iac-install.html | 2 +- .../argocd-iac-namespace-install.html | 2 +- docs/snyk/{v2.7.6 => v2.7.7}/argocd-test.html | 10 +- .../v2.7.7/ghcr.io_dexidp_dex_v2.37.0.html | 483 ++++++ .../haproxy_2.6.14-alpine.html | 2 +- .../quay.io_argoproj_argocd_v2.7.7.html} | 798 +++++----- .../redis_7.0.11-alpine.html | 2 +- .../ghcr.io_dexidp_dex_v2.36.0.html | 1245 --------------- .../argocd-iac-install.html | 2 +- .../argocd-iac-namespace-install.html | 2 +- .../argocd-test.html | 168 +- .../ghcr.io_dexidp_dex_v2.37.0.html | 483 ++++++ .../haproxy_2.6.14-alpine.html | 2 +- .../quay.io_argoproj_argocd_v2.8.0-rc2.html} | 684 ++++++-- .../redis_7.0.11-alpine.html | 2 +- 41 files changed, 6030 insertions(+), 7285 deletions(-) delete mode 100644 docs/snyk/master/ghcr.io_dexidp_dex_v2.36.0.html create mode 100644 docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html delete mode 100644 docs/snyk/v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html rename docs/snyk/{v2.5.19 => v2.5.20}/argocd-iac-install.html (99%) rename docs/snyk/{v2.5.19 => v2.5.20}/argocd-iac-namespace-install.html (99%) rename docs/snyk/{v2.5.19 => v2.5.20}/argocd-test.html (99%) create mode 100644 docs/snyk/v2.5.20/ghcr.io_dexidp_dex_v2.37.0.html rename docs/snyk/{v2.5.19 => v2.5.20}/haproxy_2.6.14-alpine.html (99%) rename docs/snyk/{v2.8.0-rc1/quay.io_argoproj_argocd_v2.8.0-rc1.html => v2.5.20/quay.io_argoproj_argocd_v2.5.20.html} (61%) rename docs/snyk/{v2.7.6 => v2.5.20}/redis_7.0.11-alpine.html (99%) delete mode 100644 docs/snyk/v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html rename docs/snyk/{v2.6.11 => v2.6.12}/argocd-iac-install.html (99%) rename docs/snyk/{v2.6.11 => v2.6.12}/argocd-iac-namespace-install.html (99%) rename docs/snyk/{v2.6.11 => v2.6.12}/argocd-test.html (98%) create mode 100644 docs/snyk/v2.6.12/ghcr.io_dexidp_dex_v2.37.0.html rename docs/snyk/{v2.7.6 => v2.6.12}/haproxy_2.6.14-alpine.html (99%) rename docs/snyk/{v2.5.19/quay.io_argoproj_argocd_v2.5.19.html => v2.6.12/quay.io_argoproj_argocd_v2.6.12.html} (83%) rename docs/snyk/{v2.5.19 => v2.6.12}/redis_7.0.11-alpine.html (99%) delete mode 100644 docs/snyk/v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html rename docs/snyk/{v2.7.6 => v2.7.7}/argocd-iac-install.html (99%) rename docs/snyk/{v2.7.6 => v2.7.7}/argocd-iac-namespace-install.html (99%) rename docs/snyk/{v2.7.6 => v2.7.7}/argocd-test.html (98%) create mode 100644 docs/snyk/v2.7.7/ghcr.io_dexidp_dex_v2.37.0.html rename docs/snyk/{v2.8.0-rc1 => v2.7.7}/haproxy_2.6.14-alpine.html (99%) rename docs/snyk/{v2.6.11/quay.io_argoproj_argocd_v2.6.11.html => v2.7.7/quay.io_argoproj_argocd_v2.7.7.html} (83%) rename docs/snyk/{v2.6.11 => v2.7.7}/redis_7.0.11-alpine.html (99%) delete mode 100644 docs/snyk/v2.8.0-rc1/ghcr.io_dexidp_dex_v2.36.0.html rename docs/snyk/{v2.8.0-rc1 => v2.8.0-rc2}/argocd-iac-install.html (99%) rename docs/snyk/{v2.8.0-rc1 => v2.8.0-rc2}/argocd-iac-namespace-install.html (99%) rename docs/snyk/{v2.8.0-rc1 => v2.8.0-rc2}/argocd-test.html (99%) create mode 100644 docs/snyk/v2.8.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html rename docs/snyk/{v2.6.11 => v2.8.0-rc2}/haproxy_2.6.14-alpine.html (99%) rename docs/snyk/{v2.7.6/quay.io_argoproj_argocd_v2.7.6.html => v2.8.0-rc2/quay.io_argoproj_argocd_v2.8.0-rc2.html} (77%) rename docs/snyk/{v2.8.0-rc1 => v2.8.0-rc2}/redis_7.0.11-alpine.html (99%) diff --git a/docs/snyk/index.md b/docs/snyk/index.md index aa9adc6a0c707..b27c3646f1e17 100644 --- a/docs/snyk/index.md +++ b/docs/snyk/index.md @@ -14,62 +14,62 @@ recent minor releases. | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| | [go.mod](master/argocd-test.html) | 0 | 1 | 0 | 0 | -| [ui/yarn.lock](master/argocd-test.html) | 0 | 0 | 1 | 0 | -| [dex:v2.36.0](master/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 | +| [ui/yarn.lock](master/argocd-test.html) | 0 | 1 | 0 | 0 | +| [dex:v2.37.0](master/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 0 | 0 | | [haproxy:2.6.14-alpine](master/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 0 | 17 | +| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 3 | 17 | | [redis:7.0.11-alpine](master/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | | [install.yaml](master/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](master/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.8.0-rc1 +### v2.8.0-rc2 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.8.0-rc1/argocd-test.html) | 0 | 1 | 0 | 0 | -| [ui/yarn.lock](v2.8.0-rc1/argocd-test.html) | 0 | 0 | 1 | 0 | -| [dex:v2.36.0](v2.8.0-rc1/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.8.0-rc1/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.8.0-rc1](v2.8.0-rc1/quay.io_argoproj_argocd_v2.8.0-rc1.html) | 0 | 0 | 0 | 17 | -| [redis:7.0.11-alpine](v2.8.0-rc1/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | -| [install.yaml](v2.8.0-rc1/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.8.0-rc1/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.8.0-rc2/argocd-test.html) | 0 | 1 | 0 | 0 | +| [ui/yarn.lock](v2.8.0-rc2/argocd-test.html) | 0 | 1 | 0 | 0 | +| [dex:v2.37.0](v2.8.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 0 | 0 | +| [haproxy:2.6.14-alpine](v2.8.0-rc2/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | +| [argocd:v2.8.0-rc2](v2.8.0-rc2/quay.io_argoproj_argocd_v2.8.0-rc2.html) | 0 | 0 | 3 | 17 | +| [redis:7.0.11-alpine](v2.8.0-rc2/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | +| [install.yaml](v2.8.0-rc2/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.8.0-rc2/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.7.6 +### v2.7.7 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.7.6/argocd-test.html) | 0 | 0 | 0 | 0 | -| [ui/yarn.lock](v2.7.6/argocd-test.html) | 0 | 0 | 1 | 0 | -| [dex:v2.36.0](v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.7.6/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.7.6](v2.7.6/quay.io_argoproj_argocd_v2.7.6.html) | 0 | 0 | 0 | 17 | -| [redis:7.0.11-alpine](v2.7.6/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | -| [install.yaml](v2.7.6/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.7.6/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.7.7/argocd-test.html) | 0 | 0 | 0 | 0 | +| [ui/yarn.lock](v2.7.7/argocd-test.html) | 0 | 1 | 0 | 0 | +| [dex:v2.37.0](v2.7.7/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 0 | 0 | +| [haproxy:2.6.14-alpine](v2.7.7/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | +| [argocd:v2.7.7](v2.7.7/quay.io_argoproj_argocd_v2.7.7.html) | 0 | 0 | 3 | 17 | +| [redis:7.0.11-alpine](v2.7.7/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | +| [install.yaml](v2.7.7/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.7.7/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.6.11 +### v2.6.12 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.6.11/argocd-test.html) | 0 | 0 | 0 | 0 | -| [ui/yarn.lock](v2.6.11/argocd-test.html) | 0 | 0 | 1 | 0 | -| [dex:v2.36.0](v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.6.11/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.6.11](v2.6.11/quay.io_argoproj_argocd_v2.6.11.html) | 0 | 0 | 0 | 17 | -| [redis:7.0.11-alpine](v2.6.11/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | -| [install.yaml](v2.6.11/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.6.11/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.6.12/argocd-test.html) | 0 | 0 | 0 | 0 | +| [ui/yarn.lock](v2.6.12/argocd-test.html) | 0 | 1 | 0 | 0 | +| [dex:v2.37.0](v2.6.12/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 0 | 0 | +| [haproxy:2.6.14-alpine](v2.6.12/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | +| [argocd:v2.6.12](v2.6.12/quay.io_argoproj_argocd_v2.6.12.html) | 0 | 0 | 3 | 17 | +| [redis:7.0.11-alpine](v2.6.12/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | +| [install.yaml](v2.6.12/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.6.12/argocd-iac-namespace-install.html) | - | - | - | - | -### v2.5.19 +### v2.5.20 | | Critical | High | Medium | Low | |---:|:--------:|:----:|:------:|:---:| -| [go.mod](v2.5.19/argocd-test.html) | 0 | 0 | 2 | 0 | -| [ui/yarn.lock](v2.5.19/argocd-test.html) | 0 | 0 | 5 | 0 | -| [dex:v2.36.0](v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 | -| [haproxy:2.6.14-alpine](v2.5.19/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | -| [argocd:v2.5.19](v2.5.19/quay.io_argoproj_argocd_v2.5.19.html) | 0 | 0 | 0 | 17 | -| [redis:7.0.11-alpine](v2.5.19/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | -| [install.yaml](v2.5.19/argocd-iac-install.html) | - | - | - | - | -| [namespace-install.yaml](v2.5.19/argocd-iac-namespace-install.html) | - | - | - | - | +| [go.mod](v2.5.20/argocd-test.html) | 0 | 0 | 2 | 0 | +| [ui/yarn.lock](v2.5.20/argocd-test.html) | 0 | 1 | 4 | 0 | +| [dex:v2.37.0](v2.5.20/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 0 | 0 | +| [haproxy:2.6.14-alpine](v2.5.20/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 | +| [argocd:v2.5.20](v2.5.20/quay.io_argoproj_argocd_v2.5.20.html) | 0 | 0 | 3 | 17 | +| [redis:7.0.11-alpine](v2.5.20/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 | +| [install.yaml](v2.5.20/argocd-iac-install.html) | - | - | - | - | +| [namespace-install.yaml](v2.5.20/argocd-iac-namespace-install.html) | - | - | - | - | diff --git a/docs/snyk/master/argocd-iac-install.html b/docs/snyk/master/argocd-iac-install.html index 3913d27c44b76..7b11441beb9e2 100644 --- a/docs/snyk/master/argocd-iac-install.html +++ b/docs/snyk/master/argocd-iac-install.html @@ -456,7 +456,7 @@

Snyk test report

-

July 2nd 2023, 12:19:59 am (UTC+00:00)

+

July 9th 2023, 12:21:13 am (UTC+00:00)

Scanned the following path: @@ -507,7 +507,7 @@

Role with dangerous permissions

  • - Line number: 18418 + Line number: 18454
    • @@ -553,7 +553,7 @@

    Role with dangerous permissions

  • - Line number: 18495 + Line number: 18531
    • @@ -599,7 +599,7 @@

    Role with dangerous permissions

  • - Line number: 18523 + Line number: 18559
    • @@ -645,7 +645,7 @@

    Role with dangerous permissions

  • - Line number: 18571 + Line number: 18607
    • @@ -691,7 +691,7 @@

    Role with dangerous permissions

  • - Line number: 18553 + Line number: 18589
    • @@ -737,7 +737,7 @@

    Role with dangerous permissions

  • - Line number: 18587 + Line number: 18623
    • @@ -789,7 +789,7 @@

    Container could be running with outdated image

  • - Line number: 19671 + Line number: 19707
    • @@ -847,7 +847,7 @@

    Container has no CPU limit

  • - Line number: 19058 + Line number: 19094
    • @@ -905,7 +905,7 @@

    Container has no CPU limit

  • - Line number: 19279 + Line number: 19315
    • @@ -963,7 +963,7 @@

    Container has no CPU limit

  • - Line number: 19245 + Line number: 19281
    • @@ -1021,7 +1021,7 @@

    Container has no CPU limit

  • - Line number: 19339 + Line number: 19375
    • @@ -1079,7 +1079,7 @@

    Container has no CPU limit

  • - Line number: 19426 + Line number: 19462
    • @@ -1137,7 +1137,7 @@

    Container has no CPU limit

  • - Line number: 19671 + Line number: 19707
    • @@ -1195,7 +1195,7 @@

    Container has no CPU limit

  • - Line number: 19483 + Line number: 19519
    • @@ -1253,7 +1253,7 @@

    Container has no CPU limit

  • - Line number: 19756 + Line number: 19792
    • @@ -1311,7 +1311,7 @@

    Container has no CPU limit

  • - Line number: 20072 + Line number: 20108
    • @@ -1363,7 +1363,7 @@

    Container is running with multiple open ports

  • - Line number: 19259 + Line number: 19295
    • @@ -1415,7 +1415,7 @@

    Container is running without liveness probe

  • - Line number: 19058 + Line number: 19094
    • @@ -1467,7 +1467,7 @@

    Container is running without liveness probe

  • - Line number: 19245 + Line number: 19281
    • @@ -1519,7 +1519,7 @@

    Container is running without liveness probe

  • - Line number: 19279 + Line number: 19315
    • @@ -1571,7 +1571,7 @@

    Container is running without liveness probe

  • - Line number: 19426 + Line number: 19462
    • @@ -1623,7 +1623,7 @@

    Container is running without liveness probe

  • - Line number: 19671 + Line number: 19707
    • @@ -1681,7 +1681,7 @@

    Container is running without memory limit

  • - Line number: 19058 + Line number: 19094
    • @@ -1739,7 +1739,7 @@

    Container is running without memory limit

  • - Line number: 19245 + Line number: 19281
    • @@ -1797,7 +1797,7 @@

    Container is running without memory limit

  • - Line number: 19279 + Line number: 19315
    • @@ -1855,7 +1855,7 @@

    Container is running without memory limit

  • - Line number: 19339 + Line number: 19375
    • @@ -1913,7 +1913,7 @@

    Container is running without memory limit

  • - Line number: 19426 + Line number: 19462
    • @@ -1971,7 +1971,7 @@

    Container is running without memory limit

  • - Line number: 19671 + Line number: 19707
    • @@ -2029,7 +2029,7 @@

    Container is running without memory limit

  • - Line number: 19483 + Line number: 19519
    • @@ -2087,7 +2087,7 @@

    Container is running without memory limit

  • - Line number: 19756 + Line number: 19792
    • @@ -2145,7 +2145,7 @@

    Container is running without memory limit

  • - Line number: 20072 + Line number: 20108
    • @@ -2201,7 +2201,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19169 + Line number: 19205
    • @@ -2257,7 +2257,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19287 + Line number: 19323
    • @@ -2313,7 +2313,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19262 + Line number: 19298
    • @@ -2369,7 +2369,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19360 + Line number: 19396
    • @@ -2425,7 +2425,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19436 + Line number: 19472
    • @@ -2481,7 +2481,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19678 + Line number: 19714
    • @@ -2537,7 +2537,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19644 + Line number: 19680
    • @@ -2593,7 +2593,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 19982 + Line number: 20018
    • @@ -2649,7 +2649,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 20220 + Line number: 20256
    • diff --git a/docs/snyk/master/argocd-iac-namespace-install.html b/docs/snyk/master/argocd-iac-namespace-install.html index 7904a97c78070..f8e4ebdfe8879 100644 --- a/docs/snyk/master/argocd-iac-namespace-install.html +++ b/docs/snyk/master/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:20:10 am (UTC+00:00)

    +

    July 9th 2023, 12:21:26 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/master/argocd-test.html b/docs/snyk/master/argocd-test.html index fb4ac5530f259..dff5d4eff951a 100644 --- a/docs/snyk/master/argocd-test.html +++ b/docs/snyk/master/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:17:33 am (UTC+00:00)

    +

    July 9th 2023, 12:18:34 am (UTC+00:00)

    Scanned the following paths: @@ -468,7 +468,7 @@

    Snyk test report

    2 known vulnerabilities
    2 vulnerable dependency paths
    -
    1804 dependencies
    +
    1805 dependencies
    @@ -477,7 +477,7 @@

    Snyk test report

    -

    Denial of Service (DoS)

    +

    Regular Expression Denial of Service (ReDoS)

    @@ -486,88 +486,6 @@

    Denial of Service (DoS)

    -
      -
    • - Package Manager: golang -
      • -
    • - Vulnerable module: - - nhooyr.io/websocket -
      • - -
    • Introduced through: - - - github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 - › - nhooyr.io/websocket@1.8.6 - - - -
      • -
    - -
    - -
    - -

    Overview

    -

    nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.

    -

    Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping. - If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would - occur.

    -

    Details

    -

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    -

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    -

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    -

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    -

    Two common types of DoS vulnerabilities:

    -
      -

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      -
      • -

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      -
      • -
    -

    Remediation

    -

    Upgrade nhooyr.io/websocket to version 1.8.7 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Regular Expression Denial of Service (ReDoS)

    -
    - -
    - medium severity -
    - -
    -
    • Package Manager: npm @@ -708,6 +626,88 @@

      References

    +
    +

    Denial of Service (DoS)

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + nhooyr.io/websocket +
      • + +
    • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 + › + nhooyr.io/websocket@1.8.6 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.

    +

    Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping. + If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would + occur.

    +

    Details

    +

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    +

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    +

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    +

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    +

    Two common types of DoS vulnerabilities:

    +
      +

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      +
      • +

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      +
      • +
    +

    Remediation

    +

    Upgrade nhooyr.io/websocket to version 1.8.7 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    diff --git a/docs/snyk/master/ghcr.io_dexidp_dex_v2.36.0.html b/docs/snyk/master/ghcr.io_dexidp_dex_v2.36.0.html deleted file mode 100644 index f48acabc6b727..0000000000000 --- a/docs/snyk/master/ghcr.io_dexidp_dex_v2.36.0.html +++ /dev/null @@ -1,1245 +0,0 @@ - - - - - - - - - Snyk test report - - - - - - - - - -
    -
    -
    -
    - - - Snyk - Open Source Security - - - - - - - -
    -

    Snyk test report

    - -

    July 2nd 2023, 12:17:42 am (UTC+00:00)

    -
    -
    - Scanned the following paths: -
      -
    • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (apk)
    • ghcr.io/dexidp/dex:v2.36.0/hairyhenderson/gomplate/v3 (gomodules)
    • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
    • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
      • -
    -
    - -
    -
    5 known vulnerabilities
    -
    35 vulnerable dependency paths
    -
    760 dependencies
    -
    -
    -
    -
    - -
    -
    -
    -

    Improper Certificate Validation

    -
    - -
    - high severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    A security vulnerability has been identified in all supported versions

    -

    of OpenSSL related to the verification of X.509 certificate chains - that include policy constraints. Attackers may be able to exploit this - vulnerability by creating a malicious certificate chain that triggers - exponential use of computational resources, leading to a denial-of-service - (DoS) attack on affected systems.

    -

    Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r1 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Allocation of Resources Without Limits or Throttling

    -
    - -
    - high severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    Issue summary: Processing some specially crafted ASN.1 object identifiers or - data containing them may be very slow.

    -

    Impact summary: Applications that use OBJ_obj2txt() directly, or use any of - the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message - size limit may experience notable to very long delays when processing those - messages, which may lead to a Denial of Service.

    -

    An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - - most of which have no size limit. OBJ_obj2txt() may be used to translate - an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL - type ASN1_OBJECT) to its canonical numeric text form, which are the - sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by - periods.

    -

    When one of the sub-identifiers in the OBJECT IDENTIFIER is very large - (these are sizes that are seen as absurdly large, taking up tens or hundreds - of KiBs), the translation to a decimal number in text may take a very long - time. The time complexity is O(n^2) with 'n' being the size of the - sub-identifiers in bytes (*).

    -

    With OpenSSL 3.0, support to fetch cryptographic algorithms using names / - identifiers in string form was introduced. This includes using OBJECT - IDENTIFIERs in canonical numeric text form as identifiers for fetching - algorithms.

    -

    Such OBJECT IDENTIFIERs may be received through the ASN.1 structure - AlgorithmIdentifier, which is commonly used in multiple protocols to specify - what cryptographic algorithm should be used to sign or verify, encrypt or - decrypt, or digest passed data.

    -

    Applications that call OBJ_obj2txt() directly with untrusted data are - affected, with any version of OpenSSL. If the use is for the mere purpose - of display, the severity is considered low.

    -

    In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, - CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 - certificates, including simple things like verifying its signature.

    -

    The impact on TLS is relatively low, because all versions of OpenSSL have a - 100KiB limit on the peer's certificate chain. Additionally, this only - impacts clients, or servers that have explicitly enabled client - authentication.

    -

    In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, - such as X.509 certificates. This is assumed to not happen in such a way - that it would cause a Denial of Service, so these versions are considered - not affected by this issue in such a way that it would be cause for concern, - and the severity is therefore considered low.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.9-r0 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Improper Certificate Validation

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    Applications that use a non-default option when verifying certificates may be - vulnerable to an attack from a malicious CA to circumvent certain checks.

    -

    Invalid certificate policies in leaf certificates are silently ignored by - OpenSSL and other certificate policy checks are skipped for that certificate. - A malicious CA could use this to deliberately assert invalid certificate policies - in order to circumvent policy checking on the certificate altogether.

    -

    Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r2 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Improper Certificate Validation

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    The function X509_VERIFY_PARAM_add0_policy() is documented to - implicitly enable the certificate policy check when doing certificate - verification. However the implementation of the function does not - enable the check which allows certificates with invalid or incorrect - policies to pass the certificate verification.

    -

    As suddenly enabling the policy check could break existing deployments it was - decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() - function.

    -

    Instead the applications that require OpenSSL to perform certificate - policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly - enable the policy check by calling X509_VERIFY_PARAM_set_flags() with - the X509_V_FLAG_POLICY_CHECK flag argument.

    -

    Certificate policy checks are disabled by default in OpenSSL and are not - commonly used by applications.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r3 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Out-of-bounds Read

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM - platform contains a bug that could cause it to read past the input buffer, - leading to a crash.

    -

    Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM - platform can crash in rare circumstances. The AES-XTS algorithm is usually - used for disk encryption.

    -

    The AES-XTS cipher decryption implementation for 64 bit ARM platform will read - past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 - byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext - buffer is unmapped, this will trigger a crash which results in a denial of - service.

    -

    If an attacker can control the size and location of the ciphertext buffer - being decrypted by an application using AES-XTS on 64 bit ARM, the - application is affected. This is fairly unlikely making this issue - a Low severity one.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r4 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -
    -
    - - - diff --git a/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html new file mode 100644 index 0000000000000..606a45c9fbca5 --- /dev/null +++ b/docs/snyk/master/ghcr.io_dexidp_dex_v2.37.0.html @@ -0,0 +1,483 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    July 9th 2023, 12:18:46 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (apk)
    • ghcr.io/dexidp/dex:v2.37.0/hairyhenderson/gomplate/v3 (gomodules)
    • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
    • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
      • +
    +
    + +
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    +
    786 dependencies
    +
    +
    +
    +
    + +
    + No known vulnerabilities detected. +
    +
    + + + diff --git a/docs/snyk/master/haproxy_2.6.14-alpine.html b/docs/snyk/master/haproxy_2.6.14-alpine.html index 95c8e1441a1a0..a12c29f0b594c 100644 --- a/docs/snyk/master/haproxy_2.6.14-alpine.html +++ b/docs/snyk/master/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:17:48 am (UTC+00:00)

    +

    July 9th 2023, 12:18:53 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/master/quay.io_argoproj_argocd_latest.html b/docs/snyk/master/quay.io_argoproj_argocd_latest.html index 661953105ef0f..a8d60976762aa 100644 --- a/docs/snyk/master/quay.io_argoproj_argocd_latest.html +++ b/docs/snyk/master/quay.io_argoproj_argocd_latest.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:18:15 am (UTC+00:00)

    +

    July 9th 2023, 12:19:18 am (UTC+00:00)

    Scanned the following paths: @@ -466,9 +466,9 @@

    Snyk test report

    -
    18 known vulnerabilities
    -
    65 vulnerable dependency paths
    -
    2112 dependencies
    +
    21 known vulnerabilities
    +
    95 vulnerable dependency paths
    +
    2114 dependencies
    @@ -555,6 +555,516 @@

    References

    More about this vulnerability

    +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@latest and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@latest and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@latest and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    +

    CVE-2022-46908

    @@ -1177,6 +1687,7 @@

    References

  • ADVISORY
  • secalert@redhat.com
  • secalert@redhat.com
    • +
  • secalert@redhat.com
    • diff --git a/docs/snyk/master/redis_7.0.11-alpine.html b/docs/snyk/master/redis_7.0.11-alpine.html index c999432a79de2..27ada37d668cc 100644 --- a/docs/snyk/master/redis_7.0.11-alpine.html +++ b/docs/snyk/master/redis_7.0.11-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:18:22 am (UTC+00:00)

    +

    July 9th 2023, 12:19:25 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html b/docs/snyk/v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html deleted file mode 100644 index 8863dfbbe9f1c..0000000000000 --- a/docs/snyk/v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html +++ /dev/null @@ -1,1245 +0,0 @@ - - - - - - - - - Snyk test report - - - - - - - - - -
    -
    -
    -
    - - - Snyk - Open Source Security - - - - - - - -
    -

    Snyk test report

    - -

    July 2nd 2023, 12:29:25 am (UTC+00:00)

    -
    -
    - Scanned the following paths: -
      -
    • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (apk)
    • ghcr.io/dexidp/dex:v2.36.0/hairyhenderson/gomplate/v3 (gomodules)
    • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
    • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
      • -
    -
    - -
    -
    5 known vulnerabilities
    -
    35 vulnerable dependency paths
    -
    760 dependencies
    -
    -
    -
    -
    - -
    -
    -
    -

    Improper Certificate Validation

    -
    - -
    - high severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    A security vulnerability has been identified in all supported versions

    -

    of OpenSSL related to the verification of X.509 certificate chains - that include policy constraints. Attackers may be able to exploit this - vulnerability by creating a malicious certificate chain that triggers - exponential use of computational resources, leading to a denial-of-service - (DoS) attack on affected systems.

    -

    Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r1 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Allocation of Resources Without Limits or Throttling

    -
    - -
    - high severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    Issue summary: Processing some specially crafted ASN.1 object identifiers or - data containing them may be very slow.

    -

    Impact summary: Applications that use OBJ_obj2txt() directly, or use any of - the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message - size limit may experience notable to very long delays when processing those - messages, which may lead to a Denial of Service.

    -

    An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - - most of which have no size limit. OBJ_obj2txt() may be used to translate - an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL - type ASN1_OBJECT) to its canonical numeric text form, which are the - sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by - periods.

    -

    When one of the sub-identifiers in the OBJECT IDENTIFIER is very large - (these are sizes that are seen as absurdly large, taking up tens or hundreds - of KiBs), the translation to a decimal number in text may take a very long - time. The time complexity is O(n^2) with 'n' being the size of the - sub-identifiers in bytes (*).

    -

    With OpenSSL 3.0, support to fetch cryptographic algorithms using names / - identifiers in string form was introduced. This includes using OBJECT - IDENTIFIERs in canonical numeric text form as identifiers for fetching - algorithms.

    -

    Such OBJECT IDENTIFIERs may be received through the ASN.1 structure - AlgorithmIdentifier, which is commonly used in multiple protocols to specify - what cryptographic algorithm should be used to sign or verify, encrypt or - decrypt, or digest passed data.

    -

    Applications that call OBJ_obj2txt() directly with untrusted data are - affected, with any version of OpenSSL. If the use is for the mere purpose - of display, the severity is considered low.

    -

    In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, - CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 - certificates, including simple things like verifying its signature.

    -

    The impact on TLS is relatively low, because all versions of OpenSSL have a - 100KiB limit on the peer's certificate chain. Additionally, this only - impacts clients, or servers that have explicitly enabled client - authentication.

    -

    In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, - such as X.509 certificates. This is assumed to not happen in such a way - that it would cause a Denial of Service, so these versions are considered - not affected by this issue in such a way that it would be cause for concern, - and the severity is therefore considered low.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.9-r0 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Improper Certificate Validation

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    Applications that use a non-default option when verifying certificates may be - vulnerable to an attack from a malicious CA to circumvent certain checks.

    -

    Invalid certificate policies in leaf certificates are silently ignored by - OpenSSL and other certificate policy checks are skipped for that certificate. - A malicious CA could use this to deliberately assert invalid certificate policies - in order to circumvent policy checking on the certificate altogether.

    -

    Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r2 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Improper Certificate Validation

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    The function X509_VERIFY_PARAM_add0_policy() is documented to - implicitly enable the certificate policy check when doing certificate - verification. However the implementation of the function does not - enable the check which allows certificates with invalid or incorrect - policies to pass the certificate verification.

    -

    As suddenly enabling the policy check could break existing deployments it was - decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() - function.

    -

    Instead the applications that require OpenSSL to perform certificate - policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly - enable the policy check by calling X509_VERIFY_PARAM_set_flags() with - the X509_V_FLAG_POLICY_CHECK flag argument.

    -

    Certificate policy checks are disabled by default in OpenSSL and are not - commonly used by applications.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r3 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Out-of-bounds Read

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: alpine:3.17 -
      • -
    • - Vulnerable module: - - openssl/libcrypto3 -
      • - -
    • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

    -

    Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM - platform contains a bug that could cause it to read past the input buffer, - leading to a crash.

    -

    Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM - platform can crash in rare circumstances. The AES-XTS algorithm is usually - used for disk encryption.

    -

    The AES-XTS cipher decryption implementation for 64 bit ARM platform will read - past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 - byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext - buffer is unmapped, this will trigger a crash which results in a denial of - service.

    -

    If an attacker can control the size and location of the ciphertext buffer - being decrypted by an application using AES-XTS on 64 bit ARM, the - application is affected. This is fairly unlikely making this issue - a Low severity one.

    -

    Remediation

    -

    Upgrade Alpine:3.17 openssl to version 3.0.8-r4 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -
    -
    - - - diff --git a/docs/snyk/v2.5.19/argocd-iac-install.html b/docs/snyk/v2.5.20/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.5.19/argocd-iac-install.html rename to docs/snyk/v2.5.20/argocd-iac-install.html index 49def2bff8c5e..f03aa03e35e63 100644 --- a/docs/snyk/v2.5.19/argocd-iac-install.html +++ b/docs/snyk/v2.5.20/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:30:54 am (UTC+00:00)

    +

    July 9th 2023, 12:34:20 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.5.19/argocd-iac-namespace-install.html b/docs/snyk/v2.5.20/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.5.19/argocd-iac-namespace-install.html rename to docs/snyk/v2.5.20/argocd-iac-namespace-install.html index 9006b033e50da..808622da80dc5 100644 --- a/docs/snyk/v2.5.19/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.5.20/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:31:08 am (UTC+00:00)

    +

    July 9th 2023, 12:34:34 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.5.19/argocd-test.html b/docs/snyk/v2.5.20/argocd-test.html similarity index 99% rename from docs/snyk/v2.5.19/argocd-test.html rename to docs/snyk/v2.5.20/argocd-test.html index 01619e458857e..3eaa49d7e71ce 100644 --- a/docs/snyk/v2.5.19/argocd-test.html +++ b/docs/snyk/v2.5.20/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:29:15 am (UTC+00:00)

    +

    July 9th 2023, 12:32:28 am (UTC+00:00)

    Scanned the following paths: @@ -476,12 +476,12 @@

    Snyk test report

    -
    +

    Regular Expression Denial of Service (ReDoS)

    -
    - medium severity +
    + high severity
    diff --git a/docs/snyk/v2.5.20/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.5.20/ghcr.io_dexidp_dex_v2.37.0.html new file mode 100644 index 0000000000000..40175527343b2 --- /dev/null +++ b/docs/snyk/v2.5.20/ghcr.io_dexidp_dex_v2.37.0.html @@ -0,0 +1,483 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
    +
    +
    +
    + + + Snyk - Open Source Security + + + + + + + +
    +

    Snyk test report

    + +

    July 9th 2023, 12:32:36 am (UTC+00:00)

    +
    +
    + Scanned the following paths: +
      +
    • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (apk)
    • ghcr.io/dexidp/dex:v2.37.0/hairyhenderson/gomplate/v3 (gomodules)
    • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
    • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
      • +
    +
    + +
    +
    0 known vulnerabilities
    +
    0 vulnerable dependency paths
    +
    786 dependencies
    +
    +
    +
    +
    + +
    + No known vulnerabilities detected. +
    +
    + + + diff --git a/docs/snyk/v2.5.19/haproxy_2.6.14-alpine.html b/docs/snyk/v2.5.20/haproxy_2.6.14-alpine.html similarity index 99% rename from docs/snyk/v2.5.19/haproxy_2.6.14-alpine.html rename to docs/snyk/v2.5.20/haproxy_2.6.14-alpine.html index a1635e73041c3..27914ebb28b09 100644 --- a/docs/snyk/v2.5.19/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.5.20/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    July 2nd 2023, 12:29:30 am (UTC+00:00)

    +

    July 9th 2023, 12:32:46 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.8.0-rc1/quay.io_argoproj_argocd_v2.8.0-rc1.html b/docs/snyk/v2.5.20/quay.io_argoproj_argocd_v2.5.20.html similarity index 61% rename from docs/snyk/v2.8.0-rc1/quay.io_argoproj_argocd_v2.8.0-rc1.html rename to docs/snyk/v2.5.20/quay.io_argoproj_argocd_v2.5.20.html index 66e9b8c16fff7..075d3efc7f4f8 100644 --- a/docs/snyk/v2.8.0-rc1/quay.io_argoproj_argocd_v2.8.0-rc1.html +++ b/docs/snyk/v2.5.20/quay.io_argoproj_argocd_v2.5.20.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

    Snyk test report

    -

    July 2nd 2023, 12:21:36 am (UTC+00:00)

    +

    July 9th 2023, 12:33:12 am (UTC+00:00)

    Scanned the following paths:
      -
    • quay.io/argoproj/argocd:v2.8.0-rc1/argoproj/argocd (deb)
    • quay.io/argoproj/argocd:v2.8.0-rc1/argoproj/argo-cd/v2 (gomodules)
    • quay.io/argoproj/argocd:v2.8.0-rc1/kustomize/kustomize/v5 (gomodules)
    • quay.io/argoproj/argocd:v2.8.0-rc1/helm/v3 (gomodules)
    • quay.io/argoproj/argocd:v2.8.0-rc1/git-lfs/git-lfs (gomodules)
      • +
    • quay.io/argoproj/argocd:v2.5.20/argoproj/argocd (deb)
    • quay.io/argoproj/argocd:v2.5.20/argoproj/argo-cd/v2 (gomodules)
    • quay.io/argoproj/argocd:v2.5.20/kustomize/kustomize/v4 (gomodules)
    • quay.io/argoproj/argocd:v2.5.20/helm/v3 (gomodules)
    • quay.io/argoproj/argocd:v2.5.20/git-lfs/git-lfs (gomodules)
    -
    18 known vulnerabilities
    -
    65 vulnerable dependency paths
    -
    2112 dependencies
    +
    30 known vulnerabilities
    +
    106 vulnerable dependency paths
    +
    2047 dependencies
    @@ -493,12 +493,924 @@

    Denial of Service (DoS)

  • Vulnerable module: - nhooyr.io/websocket + gopkg.in/yaml.v3
  • Introduced through: - github.com/argoproj/argo-cd/v2@* and nhooyr.io/websocket@v1.8.6 + sigs.k8s.io/kustomize/kustomize/v4@* and gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b + +
    • + + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + sigs.k8s.io/kustomize/kustomize/v4@* + › + gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    gopkg.in/yaml.v3 is a YAML support package for the Go language.

    +

    Affected versions of this package are vulnerable to Denial of Service (DoS) via the Unmarshal function, which causes the program to crash when attempting to deserialize invalid input.

    +

    PoC

    + 
    package main
+        
+        import (
+            "gopkg.in/yaml.v3"
+        )
+        
+        func main() {
+            var t interface{}
+            yaml.Unmarshal([]byte("0: [:!00 \xef"), &t)
+        }
+
    +

    Details

    +

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    +

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    +

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    +

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    +

    Two common types of DoS vulnerabilities:

    +
      +

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      +
      • +

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      +
      • +
    +

    Remediation

    +

    Upgrade gopkg.in/yaml.v3 to version 3.0.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    NULL Pointer Dereference

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + gopkg.in/yaml.v3 +
      • + +
    • Introduced through: + + sigs.k8s.io/kustomize/kustomize/v4@* and gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + sigs.k8s.io/kustomize/kustomize/v4@* + › + gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    gopkg.in/yaml.v3 is a YAML support package for the Go language.

    +

    Affected versions of this package are vulnerable to NULL Pointer Dereference when parsing #\n-\n-\n0 via the parserc.go parser.

    +

    PoC

    + 
    package main
+        
+        import (
+            "gopkg.in/yaml.v3"
+        )
+        
+        func main() {
+            var t interface{}
+            yaml.Unmarshal([]byte("#\n-\n-\n0"), &t)
+        }
+
    +

    Remediation

    +

    Upgrade gopkg.in/yaml.v3 to version 3.0.1 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Denial of Service (DoS)

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/net/http2/hpack +
      • + +
    • Introduced through: + + sigs.k8s.io/kustomize/kustomize/v4@* and golang.org/x/net/http2/hpack@v0.0.0-20220127200216-cd36cc0744dd + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + sigs.k8s.io/kustomize/kustomize/v4@* + › + golang.org/x/net/http2/hpack@v0.0.0-20220127200216-cd36cc0744dd + + + +
      • +
    • + Introduced through: + helm.sh/helm/v3@* + › + golang.org/x/net/http2/hpack@v0.0.0-20220722155237-a158d28d115b + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

    +

    Details

    +

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    +

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    +

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    +

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    +

    Two common types of DoS vulnerabilities:

    +
      +

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      +
      • +

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      +
      • +
    +

    Remediation

    +

    Upgrade golang.org/x/net/http2/hpack to version 0.7.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Denial of Service

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/net/http2 +
      • + +
    • Introduced through: + + helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + helm.sh/helm/v3@* + › + golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

    +

    Affected versions of this package are vulnerable to Denial of Service as an HTTP/2 connection can hang during closing if a shutdown was preempted by a fatal error.

    +

    Remediation

    +

    Upgrade golang.org/x/net/http2 to version 0.0.0-20220906165146-f3363e06e74c, 1.18.6, 1.19.1 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Denial of Service (DoS)

    +
    + +
    + high severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/net/http2 +
      • + +
    • Introduced through: + + helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + helm.sh/helm/v3@* + › + golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

    +

    Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

    +

    Details

    +

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    +

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    +

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    +

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    +

    Two common types of DoS vulnerabilities:

    +
      +

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      +
      • +

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      +
      • +
    +

    Remediation

    +

    Upgrade golang.org/x/net/http2 to version 0.7.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.5.20 and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.5.20 and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.5.20 and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.5.20 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Denial of Service (DoS)

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + gopkg.in/yaml.v2 +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and gopkg.in/yaml.v2@v2.2.4
    @@ -513,7 +1425,228 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@* › - nhooyr.io/websocket@v1.8.6 + gopkg.in/yaml.v2@v2.2.4 + + + + + + +
    + +
    + +

    Overview

    +

    gopkg.in/yaml.v2 is a YAML support package for the Go language.

    +

    Affected versions of this package are vulnerable to Denial of Service (DoS). It is possible for authorized users to send malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML.

    +

    Details

    +

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    +

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    +

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    +

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    +

    Two common types of DoS vulnerabilities:

    +
      +

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      +
      • +

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      +
      • +
    +

    Remediation

    +

    Upgrade gopkg.in/yaml.v2 to version 2.2.8 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Input Validation

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/text/language +
      • + +
    • Introduced through: + + sigs.k8s.io/kustomize/kustomize/v4@* and golang.org/x/text/language@v0.3.7 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + sigs.k8s.io/kustomize/kustomize/v4@* + › + golang.org/x/text/language@v0.3.7 + + + +
      • +
    • + Introduced through: + helm.sh/helm/v3@* + › + golang.org/x/text/language@v0.3.7 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Improper Input Validation due to the parser being, by design, exposed to untrusted user input, which can be leveraged to force a program to consume significant time parsing Accept-Language headers.

    +

    Remediation

    +

    Upgrade golang.org/x/text/language to version 0.3.8 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Incorrect Privilege Assignment

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/sys/unix +
      • + +
    • Introduced through: + + helm.sh/helm/v3@* and golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + helm.sh/helm/v3@* + › + golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    Affected versions of this package are vulnerable to Incorrect Privilege Assignment such that when called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible.

    +

    Remediation

    +

    Upgrade golang.org/x/sys/unix to version 0.1.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Denial of Service (DoS)

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + golang.org/x/net/http2 +
      • + +
    • Introduced through: + + helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + helm.sh/helm/v3@* + › + golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b @@ -525,10 +1658,8 @@

      Detailed paths

      Overview

      -

      nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping. - If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would - occur.

      +

      golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

      +

      Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper checks and limitations for the number of entries in the cache, which can allow an attacker to consume unbounded amounts of memory by sending a small number of very large keys.

      Details

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      @@ -542,17 +1673,86 @@

      Details

    Remediation

    -

    Upgrade nhooyr.io/websocket to version 1.8.7 or higher.

    +

    Upgrade golang.org/x/net/http2 to version 0.4.0 or higher.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Input Validation

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: golang +
      • +
    • + Vulnerable module: + + go.mongodb.org/mongo-driver/bson/bsonrw +
      • + +
    • Introduced through: + + github.com/argoproj/argo-cd/v2@* and go.mongodb.org/mongo-driver/bson/bsonrw@v1.1.2 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + github.com/argoproj/argo-cd/v2@* + › + go.mongodb.org/mongo-driver/bson/bsonrw@v1.1.2 + + + +
      • +
    + +
    + +
    + +

    Overview

    +

    go.mongodb.org/mongo-driver/bson/bsonrw is a The MongoDB supported driver for Go.

    +

    Affected versions of this package are vulnerable to Improper Input Validation. Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents.

    +

    Remediation

    +

    Upgrade go.mongodb.org/mongo-driver/bson/bsonrw to version 1.5.1 or higher.

    References

    -

    More about this vulnerability

    +

    More about this vulnerability

    @@ -579,7 +1779,7 @@

    CVE-2022-46908

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1, gnupg2/gpg@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.5.20, gnupg2/gpg@2.2.27-3ubuntu2.1 and others
    • @@ -591,7 +1791,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -650,7 +1850,7 @@

      Arbitrary Code Injection

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and shadow/passwd@1:4.8.1-2ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and shadow/passwd@1:4.8.1-2ubuntu2.1
    @@ -663,7 +1863,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › shadow/passwd@1:4.8.1-2ubuntu2.1 @@ -672,7 +1872,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › adduser@3.118ubuntu5 › @@ -683,7 +1883,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -694,7 +1894,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › shadow/login@1:4.8.1-2ubuntu2.1 @@ -751,7 +1951,7 @@

      Uncontrolled Recursion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    @@ -764,7 +1964,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 @@ -773,7 +1973,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › grep@3.7-1build1 › @@ -835,7 +2035,7 @@

      Release of Invalid Pointer or Reference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.5.20 and patch@2.7.6-7build2
    @@ -848,7 +2048,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › patch@2.7.6-7build2 @@ -902,7 +2102,7 @@

      Double Free

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.5.20 and patch@2.7.6-7build2
    @@ -915,7 +2115,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › patch@2.7.6-7build2 @@ -974,7 +2174,7 @@

      Information Exposure

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -987,7 +2187,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1048,7 +2248,7 @@

      CVE-2023-28531

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1061,7 +2261,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1117,7 +2317,7 @@

      NULL Pointer Dereference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.5.20, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others
    @@ -1129,7 +2329,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -1140,7 +2340,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 › @@ -1153,7 +2353,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › openldap/libldap-common@2.5.14+dfsg-0ubuntu0.22.04.2 @@ -1177,6 +2377,7 @@

      References

    • ADVISORY
    • secalert@redhat.com
    • secalert@redhat.com
      • +
    • secalert@redhat.com
    @@ -1209,7 +2410,7 @@

    Resource Exhaustion

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1, meta-common-packages@meta and others + docker-image|quay.io/argoproj/argocd@v2.5.20, meta-common-packages@meta and others
    • @@ -1221,7 +2422,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › meta-common-packages@meta › @@ -1277,7 +2478,7 @@

      Integer Overflow or Wraparound

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.5.20 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -1290,7 +2491,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › krb5/libk5crypto3@1.19.2-2ubuntu0.2 @@ -1299,7 +2500,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › adduser@3.118ubuntu5 › @@ -1320,7 +2521,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › adduser@3.118ubuntu5 › @@ -1343,7 +2544,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › krb5/libkrb5-3@1.19.2-2ubuntu0.2 @@ -1352,7 +2553,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › adduser@3.118ubuntu5 › @@ -1373,7 +2574,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -1382,7 +2583,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -1393,7 +2594,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 › @@ -1406,7 +2607,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 › @@ -1421,7 +2622,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › adduser@3.118ubuntu5 › @@ -1440,7 +2641,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › meta-common-packages@meta › @@ -1499,7 +2700,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and gnupg2/gpgv@2.2.27-3ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and gnupg2/gpgv@2.2.27-3ubuntu2.1
    @@ -1512,7 +2713,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpgv@2.2.27-3ubuntu2.1 @@ -1521,7 +2722,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › apt@2.4.9 › @@ -1532,7 +2733,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1543,7 +2744,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -1554,7 +2755,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -1565,7 +2766,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1578,7 +2779,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1591,7 +2792,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 @@ -1600,7 +2801,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1611,7 +2812,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1624,7 +2825,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1 @@ -1633,7 +2834,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1644,7 +2845,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 @@ -1653,7 +2854,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1664,7 +2865,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpg@2.2.27-3ubuntu2.1 @@ -1673,7 +2874,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1684,7 +2885,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1697,7 +2898,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1710,7 +2911,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 @@ -1719,7 +2920,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1730,7 +2931,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1743,7 +2944,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1756,7 +2957,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 @@ -1765,7 +2966,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1776,7 +2977,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 @@ -1785,7 +2986,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1796,7 +2997,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 @@ -1805,7 +3006,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1816,7 +3017,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › gnupg2/gnupg@2.2.27-3ubuntu2.1 @@ -1875,7 +3076,7 @@

      Allocation of Resources Without Limits or Throttling

      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and glibc/libc-bin@2.35-0ubuntu3.1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and glibc/libc-bin@2.35-0ubuntu3.1
    @@ -1888,7 +3089,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › glibc/libc-bin@2.35-0ubuntu3.1 @@ -1897,7 +3098,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › meta-common-packages@meta › @@ -1956,7 +3157,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.5.20, git@1:2.34.1-1ubuntu1.9 and others
    @@ -1968,7 +3169,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 › @@ -1979,7 +3180,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 @@ -1988,7 +3189,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git-lfs@3.0.2-1ubuntu0.2 › @@ -2046,7 +3247,7 @@

      CVE-2023-28322

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.5.20, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2058,7 +3259,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 › @@ -2118,7 +3319,7 @@

      Improper Certificate Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.5.20, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2130,7 +3331,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › git@1:2.34.1-1ubuntu1.9 › @@ -2189,7 +3390,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and coreutils@8.32-4.1ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and coreutils@8.32-4.1ubuntu1
    @@ -2202,7 +3403,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › coreutils@8.32-4.1ubuntu1 @@ -2259,7 +3460,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 and bash@5.1-6ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.5.20 and bash@5.1-6ubuntu1
    @@ -2272,7 +3473,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.8.0-rc1 + docker-image|quay.io/argoproj/argocd@v2.5.20 › bash@5.1-6ubuntu1 diff --git a/docs/snyk/v2.7.6/redis_7.0.11-alpine.html b/docs/snyk/v2.5.20/redis_7.0.11-alpine.html similarity index 99% rename from docs/snyk/v2.7.6/redis_7.0.11-alpine.html rename to docs/snyk/v2.5.20/redis_7.0.11-alpine.html index d623788c90d3a..fa6d133bffd86 100644 --- a/docs/snyk/v2.7.6/redis_7.0.11-alpine.html +++ b/docs/snyk/v2.5.20/redis_7.0.11-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:24:30 am (UTC+00:00)

      +

      July 9th 2023, 12:33:18 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html b/docs/snyk/v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html deleted file mode 100644 index 61b6c2658c17b..0000000000000 --- a/docs/snyk/v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html +++ /dev/null @@ -1,1245 +0,0 @@ - - - - - - - - - Snyk test report - - - - - - - - - -
      -
      -
      -
      - - - Snyk - Open Source Security - - - - - - - -
      -

      Snyk test report

      - -

      July 2nd 2023, 12:26:39 am (UTC+00:00)

      -
      -
      - Scanned the following paths: -
        -
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (apk)
      • ghcr.io/dexidp/dex:v2.36.0/hairyhenderson/gomplate/v3 (gomodules)
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
        • -
      -
      - -
      -
      5 known vulnerabilities
      -
      35 vulnerable dependency paths
      -
      760 dependencies
      -
      -
      -
      -
      - -
      -
      -
      -

      Improper Certificate Validation

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      A security vulnerability has been identified in all supported versions

      -

      of OpenSSL related to the verification of X.509 certificate chains - that include policy constraints. Attackers may be able to exploit this - vulnerability by creating a malicious certificate chain that triggers - exponential use of computational resources, leading to a denial-of-service - (DoS) attack on affected systems.

      -

      Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r1 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Allocation of Resources Without Limits or Throttling

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Issue summary: Processing some specially crafted ASN.1 object identifiers or - data containing them may be very slow.

      -

      Impact summary: Applications that use OBJ_obj2txt() directly, or use any of - the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message - size limit may experience notable to very long delays when processing those - messages, which may lead to a Denial of Service.

      -

      An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - - most of which have no size limit. OBJ_obj2txt() may be used to translate - an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL - type ASN1_OBJECT) to its canonical numeric text form, which are the - sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by - periods.

      -

      When one of the sub-identifiers in the OBJECT IDENTIFIER is very large - (these are sizes that are seen as absurdly large, taking up tens or hundreds - of KiBs), the translation to a decimal number in text may take a very long - time. The time complexity is O(n^2) with 'n' being the size of the - sub-identifiers in bytes (*).

      -

      With OpenSSL 3.0, support to fetch cryptographic algorithms using names / - identifiers in string form was introduced. This includes using OBJECT - IDENTIFIERs in canonical numeric text form as identifiers for fetching - algorithms.

      -

      Such OBJECT IDENTIFIERs may be received through the ASN.1 structure - AlgorithmIdentifier, which is commonly used in multiple protocols to specify - what cryptographic algorithm should be used to sign or verify, encrypt or - decrypt, or digest passed data.

      -

      Applications that call OBJ_obj2txt() directly with untrusted data are - affected, with any version of OpenSSL. If the use is for the mere purpose - of display, the severity is considered low.

      -

      In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, - CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 - certificates, including simple things like verifying its signature.

      -

      The impact on TLS is relatively low, because all versions of OpenSSL have a - 100KiB limit on the peer's certificate chain. Additionally, this only - impacts clients, or servers that have explicitly enabled client - authentication.

      -

      In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, - such as X.509 certificates. This is assumed to not happen in such a way - that it would cause a Denial of Service, so these versions are considered - not affected by this issue in such a way that it would be cause for concern, - and the severity is therefore considered low.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.9-r0 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Improper Certificate Validation

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Applications that use a non-default option when verifying certificates may be - vulnerable to an attack from a malicious CA to circumvent certain checks.

      -

      Invalid certificate policies in leaf certificates are silently ignored by - OpenSSL and other certificate policy checks are skipped for that certificate. - A malicious CA could use this to deliberately assert invalid certificate policies - in order to circumvent policy checking on the certificate altogether.

      -

      Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r2 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Improper Certificate Validation

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      The function X509_VERIFY_PARAM_add0_policy() is documented to - implicitly enable the certificate policy check when doing certificate - verification. However the implementation of the function does not - enable the check which allows certificates with invalid or incorrect - policies to pass the certificate verification.

      -

      As suddenly enabling the policy check could break existing deployments it was - decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() - function.

      -

      Instead the applications that require OpenSSL to perform certificate - policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly - enable the policy check by calling X509_VERIFY_PARAM_set_flags() with - the X509_V_FLAG_POLICY_CHECK flag argument.

      -

      Certificate policy checks are disabled by default in OpenSSL and are not - commonly used by applications.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Out-of-bounds Read

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM - platform contains a bug that could cause it to read past the input buffer, - leading to a crash.

      -

      Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM - platform can crash in rare circumstances. The AES-XTS algorithm is usually - used for disk encryption.

      -

      The AES-XTS cipher decryption implementation for 64 bit ARM platform will read - past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 - byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext - buffer is unmapped, this will trigger a crash which results in a denial of - service.

      -

      If an attacker can control the size and location of the ciphertext buffer - being decrypted by an application using AES-XTS on 64 bit ARM, the - application is affected. This is fairly unlikely making this issue - a Low severity one.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r4 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -
      -
      - - - diff --git a/docs/snyk/v2.6.11/argocd-iac-install.html b/docs/snyk/v2.6.12/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.6.11/argocd-iac-install.html rename to docs/snyk/v2.6.12/argocd-iac-install.html index 49e0deec9a697..7e0c0c47dbbe7 100644 --- a/docs/snyk/v2.6.11/argocd-iac-install.html +++ b/docs/snyk/v2.6.12/argocd-iac-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:28:41 am (UTC+00:00)

      +

      July 9th 2023, 12:31:50 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.6.11/argocd-iac-namespace-install.html b/docs/snyk/v2.6.12/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.6.11/argocd-iac-namespace-install.html rename to docs/snyk/v2.6.12/argocd-iac-namespace-install.html index 48cce96ea2b1d..ed77c2323ab38 100644 --- a/docs/snyk/v2.6.11/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.6.12/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:28:53 am (UTC+00:00)

      +

      July 9th 2023, 12:32:05 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.6.11/argocd-test.html b/docs/snyk/v2.6.12/argocd-test.html similarity index 98% rename from docs/snyk/v2.6.11/argocd-test.html rename to docs/snyk/v2.6.12/argocd-test.html index 3fdb9d1f5ad5d..a0a754f473dca 100644 --- a/docs/snyk/v2.6.11/argocd-test.html +++ b/docs/snyk/v2.6.12/argocd-test.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:26:28 am (UTC+00:00)

      +

      July 9th 2023, 12:28:39 am (UTC+00:00)

      Scanned the following paths: @@ -468,7 +468,7 @@

      Snyk test report

      1 known vulnerabilities
      1 vulnerable dependency paths
      -
      1728 dependencies
      +
      1727 dependencies
      @@ -476,12 +476,12 @@

      Snyk test report

      -
      +

      Regular Expression Denial of Service (ReDoS)

      -
      - medium severity +
      + high severity
      diff --git a/docs/snyk/v2.6.12/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.6.12/ghcr.io_dexidp_dex_v2.37.0.html new file mode 100644 index 0000000000000..4a788356b57a4 --- /dev/null +++ b/docs/snyk/v2.6.12/ghcr.io_dexidp_dex_v2.37.0.html @@ -0,0 +1,483 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
      +
      +
      +
      + + + Snyk - Open Source Security + + + + + + + +
      +

      Snyk test report

      + +

      July 9th 2023, 12:28:45 am (UTC+00:00)

      +
      +
      + Scanned the following paths: +
        +
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (apk)
      • ghcr.io/dexidp/dex:v2.37.0/hairyhenderson/gomplate/v3 (gomodules)
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
        • +
      +
      + +
      +
      0 known vulnerabilities
      +
      0 vulnerable dependency paths
      +
      786 dependencies
      +
      +
      +
      +
      + +
      + No known vulnerabilities detected. +
      +
      + + + diff --git a/docs/snyk/v2.7.6/haproxy_2.6.14-alpine.html b/docs/snyk/v2.6.12/haproxy_2.6.14-alpine.html similarity index 99% rename from docs/snyk/v2.7.6/haproxy_2.6.14-alpine.html rename to docs/snyk/v2.6.12/haproxy_2.6.14-alpine.html index f34beedcfc0e0..fc41b97cb25eb 100644 --- a/docs/snyk/v2.7.6/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.6.12/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:24:02 am (UTC+00:00)

      +

      July 9th 2023, 12:28:50 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.5.19/quay.io_argoproj_argocd_v2.5.19.html b/docs/snyk/v2.6.12/quay.io_argoproj_argocd_v2.6.12.html similarity index 83% rename from docs/snyk/v2.5.19/quay.io_argoproj_argocd_v2.5.19.html rename to docs/snyk/v2.6.12/quay.io_argoproj_argocd_v2.6.12.html index 5df94a5fa01db..cc429f754e2fd 100644 --- a/docs/snyk/v2.5.19/quay.io_argoproj_argocd_v2.5.19.html +++ b/docs/snyk/v2.6.12/quay.io_argoproj_argocd_v2.6.12.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

      Snyk test report

      -

      July 2nd 2023, 12:29:53 am (UTC+00:00)

      +

      July 9th 2023, 12:30:05 am (UTC+00:00)

      Scanned the following paths:
        -
      • quay.io/argoproj/argocd:v2.5.19/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.5.19/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.5.19/kustomize/kustomize/v4 (gomodules)
      • quay.io/argoproj/argocd:v2.5.19/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.5.19/git-lfs/git-lfs (gomodules)
        • +
      • quay.io/argoproj/argocd:v2.6.12/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.6.12/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.6.12/kustomize/kustomize/v4 (gomodules)
      • quay.io/argoproj/argocd:v2.6.12/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.6.12/git-lfs/git-lfs (gomodules)
      -
      27 known vulnerabilities
      -
      76 vulnerable dependency paths
      -
      2047 dependencies
      +
      28 known vulnerabilities
      +
      104 vulnerable dependency paths
      +
      2064 dependencies
      @@ -879,7 +879,7 @@

      References

      -

      Denial of Service (DoS)

      +

      Improper Validation of Integrity Check Value

      @@ -890,17 +890,17 @@

      Denial of Service (DoS)

      • - Package Manager: golang + Package Manager: ubuntu:22.04
      • Vulnerable module: - gopkg.in/yaml.v2 + systemd/libsystemd0
      • Introduced through: - github.com/argoproj/argo-cd/v2@* and gopkg.in/yaml.v2@v2.2.4 + docker-image|quay.io/argoproj/argocd@v2.6.12 and systemd/libsystemd0@249.11-0ubuntu3.9
      @@ -913,9 +913,110 @@

      Detailed paths

      • Introduced through: - github.com/argoproj/argo-cd/v2@* + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 › - gopkg.in/yaml.v2@v2.2.4 + systemd/libudev1@249.11-0ubuntu3.9 @@ -926,39 +1027,199 @@

        Detailed paths

        -

        Overview

        -

        gopkg.in/yaml.v2 is a YAML support package for the Go language.

        -

        Affected versions of this package are vulnerable to Denial of Service (DoS). It is possible for authorized users to send malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML.

        -

        Details

        -

        Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

        -

        Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

        -

        One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

        -

        When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

        -

        Two common types of DoS vulnerabilities:

        +

        NVD Description

        +

        Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

        +

        ** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

        +

        Remediation

        +

        There is no fixed version for Ubuntu:22.04 systemd.

        +

        References

        + +
        + +
        +

        More about this vulnerability

        +
        + +
      +
      +

      Improper Validation of Integrity Check Value

      +
      + +
      + medium severity +
      + +
      + +
        +
      • + Package Manager: ubuntu:22.04 +
        • +
      • + Vulnerable module: + + systemd/libsystemd0 +
        • + +
      • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.6.12 and systemd/libsystemd0@249.11-0ubuntu3.9 + +
        • +
      + +
      + + +

      Detailed paths

      + +
        +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      + +
      + +
      + +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      +

      ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

      Remediation

      -

      Upgrade gopkg.in/yaml.v2 to version 2.2.8 or higher.

      +

      There is no fixed version for Ubuntu:22.04 systemd.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

      -

      Improper Input Validation

      +

      Improper Validation of Integrity Check Value

      @@ -969,17 +1230,17 @@

      Improper Input Validation

      • - Package Manager: golang + Package Manager: ubuntu:22.04
      • Vulnerable module: - golang.org/x/text/language + systemd/libsystemd0
      • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* and golang.org/x/text/language@v0.3.7 + docker-image|quay.io/argoproj/argocd@v2.6.12 and systemd/libsystemd0@249.11-0ubuntu3.9
      @@ -992,18 +1253,110 @@

      Detailed paths

      • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* + docker-image|quay.io/argoproj/argocd@v2.6.12 › - golang.org/x/text/language@v0.3.7 + systemd/libsystemd0@249.11-0ubuntu3.9
      • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.6.12 › - golang.org/x/text/language@v0.3.7 + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
        • +
      • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.6.12 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 @@ -1014,28 +1367,29 @@

        Detailed paths

        -

        Overview

        -

        Affected versions of this package are vulnerable to Improper Input Validation due to the parser being, by design, exposed to untrusted user input, which can be leveraged to force a program to consume significant time parsing Accept-Language headers.

        +

        NVD Description

        +

        Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

        +

        ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

        Remediation

        -

        Upgrade golang.org/x/text/language to version 0.3.8 or higher.

        +

        There is no fixed version for Ubuntu:22.04 systemd.

        References

        -

        More about this vulnerability

        +

        More about this vulnerability

      -

      Incorrect Privilege Assignment

      +

      Improper Input Validation

      @@ -1051,12 +1405,12 @@

      Incorrect Privilege Assignment

    • Vulnerable module: - golang.org/x/sys/unix + golang.org/x/text/language
    • Introduced through: - helm.sh/helm/v3@* and golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f + sigs.k8s.io/kustomize/kustomize/v4@* and golang.org/x/text/language@v0.3.7
    @@ -1067,11 +1421,20 @@

    Incorrect Privilege Assignment

    Detailed paths

      +
    • + Introduced through: + sigs.k8s.io/kustomize/kustomize/v4@* + › + golang.org/x/text/language@v0.3.7 + + + +
    • Introduced through: helm.sh/helm/v3@* › - golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f + golang.org/x/text/language@v0.3.7 @@ -1083,24 +1446,27 @@

      Detailed paths

      Overview

      -

      Affected versions of this package are vulnerable to Incorrect Privilege Assignment such that when called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible.

      +

      Affected versions of this package are vulnerable to Improper Input Validation due to the parser being, by design, exposed to untrusted user input, which can be leveraged to force a program to consume significant time parsing Accept-Language headers.

      Remediation

      -

      Upgrade golang.org/x/sys/unix to version 0.1.0 or higher.

      +

      Upgrade golang.org/x/text/language to version 0.3.8 or higher.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Denial of Service (DoS)

    +

    Incorrect Privilege Assignment

    @@ -1116,12 +1482,12 @@

    Denial of Service (DoS)

  • Vulnerable module: - golang.org/x/net/http2 + golang.org/x/sys/unix
  • Introduced through: - helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + helm.sh/helm/v3@* and golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f
    • @@ -1136,7 +1502,7 @@

    Detailed paths

    Introduced through: helm.sh/helm/v3@* › - golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f @@ -1148,39 +1514,24 @@

    Detailed paths

    Overview

    -

    golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

    -

    Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper checks and limitations for the number of entries in the cache, which can allow an attacker to consume unbounded amounts of memory by sending a small number of very large keys.

    -

    Details

    -

    Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

    -

    Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

    -

    One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

    -

    When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

    -

    Two common types of DoS vulnerabilities:

    -
      -

    • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

      -
      • -

    • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

      -
      • -
    +

    Affected versions of this package are vulnerable to Incorrect Privilege Assignment such that when called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible.

    Remediation

    -

    Upgrade golang.org/x/net/http2 to version 0.4.0 or higher.

    +

    Upgrade golang.org/x/sys/unix to version 0.1.0 or higher.

    References

    -

    More about this vulnerability

    +

    More about this vulnerability

    -

    Improper Input Validation

    +

    Denial of Service (DoS)

    @@ -1196,12 +1547,12 @@

    Improper Input Validation

  • Vulnerable module: - go.mongodb.org/mongo-driver/bson/bsonrw + golang.org/x/net/http2
  • Introduced through: - github.com/argoproj/argo-cd/v2@* and go.mongodb.org/mongo-driver/bson/bsonrw@v1.1.2 + helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b
    • @@ -1214,9 +1565,9 @@

    Detailed paths

    • Introduced through: - github.com/argoproj/argo-cd/v2@* + helm.sh/helm/v3@* › - go.mongodb.org/mongo-driver/bson/bsonrw@v1.1.2 + golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b @@ -1228,21 +1579,34 @@

      Detailed paths

      Overview

      -

      go.mongodb.org/mongo-driver/bson/bsonrw is a The MongoDB supported driver for Go.

      -

      Affected versions of this package are vulnerable to Improper Input Validation. Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents.

      +

      golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

      +

      Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper checks and limitations for the number of entries in the cache, which can allow an attacker to consume unbounded amounts of memory by sending a small number of very large keys.

      +

      Details

      +

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      +

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      +

      One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

      +

      When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

      +

      Two common types of DoS vulnerabilities:

      +
        +

      • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

        +
        • +

      • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

        +
        • +

      Remediation

      -

      Upgrade go.mongodb.org/mongo-driver/bson/bsonrw to version 1.5.1 or higher.

      +

      Upgrade golang.org/x/net/http2 to version 0.4.0 or higher.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    @@ -1269,7 +1633,7 @@

    CVE-2022-46908

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19, gnupg2/gpg@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.6.12, gnupg2/gpg@2.2.27-3ubuntu2.1 and others
    • @@ -1281,7 +1645,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -1340,7 +1704,7 @@

      Arbitrary Code Injection

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and shadow/passwd@1:4.8.1-2ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and shadow/passwd@1:4.8.1-2ubuntu2.1
    @@ -1353,7 +1717,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › shadow/passwd@1:4.8.1-2ubuntu2.1 @@ -1362,7 +1726,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › adduser@3.118ubuntu5 › @@ -1373,7 +1737,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -1384,7 +1748,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › shadow/login@1:4.8.1-2ubuntu2.1 @@ -1441,7 +1805,7 @@

      Uncontrolled Recursion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    @@ -1454,7 +1818,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 @@ -1463,7 +1827,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › grep@3.7-1build1 › @@ -1525,7 +1889,7 @@

      Release of Invalid Pointer or Reference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.6.12 and patch@2.7.6-7build2
    @@ -1538,7 +1902,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › patch@2.7.6-7build2 @@ -1592,7 +1956,7 @@

      Double Free

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.6.12 and patch@2.7.6-7build2
    @@ -1605,7 +1969,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › patch@2.7.6-7build2 @@ -1664,7 +2028,7 @@

      Information Exposure

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1677,7 +2041,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1738,7 +2102,7 @@

      CVE-2023-28531

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1751,7 +2115,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1807,7 +2171,7 @@

      NULL Pointer Dereference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.6.12, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others
    @@ -1819,7 +2183,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -1830,7 +2194,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 › @@ -1843,7 +2207,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › openldap/libldap-common@2.5.14+dfsg-0ubuntu0.22.04.2 @@ -1867,6 +2231,7 @@

      References

    • ADVISORY
    • secalert@redhat.com
    • secalert@redhat.com
      • +
    • secalert@redhat.com
    @@ -1899,7 +2264,7 @@

    Resource Exhaustion

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19, meta-common-packages@meta and others + docker-image|quay.io/argoproj/argocd@v2.6.12, meta-common-packages@meta and others
    • @@ -1911,7 +2276,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › meta-common-packages@meta › @@ -1967,7 +2332,7 @@

      Integer Overflow or Wraparound

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.6.12 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -1980,7 +2345,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › krb5/libk5crypto3@1.19.2-2ubuntu0.2 @@ -1989,7 +2354,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › adduser@3.118ubuntu5 › @@ -2010,7 +2375,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › adduser@3.118ubuntu5 › @@ -2033,7 +2398,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › krb5/libkrb5-3@1.19.2-2ubuntu0.2 @@ -2042,7 +2407,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › adduser@3.118ubuntu5 › @@ -2063,7 +2428,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -2072,7 +2437,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -2083,7 +2448,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 › @@ -2096,7 +2461,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 › @@ -2111,7 +2476,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › adduser@3.118ubuntu5 › @@ -2130,7 +2495,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › meta-common-packages@meta › @@ -2189,7 +2554,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and gnupg2/gpgv@2.2.27-3ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and gnupg2/gpgv@2.2.27-3ubuntu2.1
    @@ -2202,7 +2567,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpgv@2.2.27-3ubuntu2.1 @@ -2211,7 +2576,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › apt@2.4.9 › @@ -2222,7 +2587,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2233,7 +2598,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -2244,7 +2609,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -2255,7 +2620,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2268,7 +2633,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2281,7 +2646,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 @@ -2290,7 +2655,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2301,7 +2666,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2314,7 +2679,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1 @@ -2323,7 +2688,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2334,7 +2699,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 @@ -2343,7 +2708,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2354,7 +2719,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpg@2.2.27-3ubuntu2.1 @@ -2363,7 +2728,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2374,7 +2739,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2387,7 +2752,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2400,7 +2765,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 @@ -2409,7 +2774,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2420,7 +2785,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2433,7 +2798,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2446,7 +2811,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 @@ -2455,7 +2820,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2466,7 +2831,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 @@ -2475,7 +2840,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2486,7 +2851,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 @@ -2495,7 +2860,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2506,7 +2871,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › gnupg2/gnupg@2.2.27-3ubuntu2.1 @@ -2565,7 +2930,7 @@

      Allocation of Resources Without Limits or Throttling

      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and glibc/libc-bin@2.35-0ubuntu3.1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and glibc/libc-bin@2.35-0ubuntu3.1
    @@ -2578,7 +2943,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › glibc/libc-bin@2.35-0ubuntu3.1 @@ -2587,7 +2952,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › meta-common-packages@meta › @@ -2646,7 +3011,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.6.12, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2658,7 +3023,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 › @@ -2669,7 +3034,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 @@ -2678,7 +3043,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git-lfs@3.0.2-1ubuntu0.2 › @@ -2736,7 +3101,7 @@

      CVE-2023-28322

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.6.12, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2748,7 +3113,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 › @@ -2808,7 +3173,7 @@

      Improper Certificate Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.6.12, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2820,7 +3185,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › git@1:2.34.1-1ubuntu1.9 › @@ -2879,7 +3244,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and coreutils@8.32-4.1ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and coreutils@8.32-4.1ubuntu1
    @@ -2892,7 +3257,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › coreutils@8.32-4.1ubuntu1 @@ -2949,7 +3314,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 and bash@5.1-6ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.6.12 and bash@5.1-6ubuntu1
    @@ -2962,7 +3327,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.5.19 + docker-image|quay.io/argoproj/argocd@v2.6.12 › bash@5.1-6ubuntu1 diff --git a/docs/snyk/v2.5.19/redis_7.0.11-alpine.html b/docs/snyk/v2.6.12/redis_7.0.11-alpine.html similarity index 99% rename from docs/snyk/v2.5.19/redis_7.0.11-alpine.html rename to docs/snyk/v2.6.12/redis_7.0.11-alpine.html index 1fc54cdc754f9..2ff2fffce00ab 100644 --- a/docs/snyk/v2.5.19/redis_7.0.11-alpine.html +++ b/docs/snyk/v2.6.12/redis_7.0.11-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:29:58 am (UTC+00:00)

      +

      July 9th 2023, 12:30:12 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html b/docs/snyk/v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html deleted file mode 100644 index a2acd78c6b7b5..0000000000000 --- a/docs/snyk/v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html +++ /dev/null @@ -1,1245 +0,0 @@ - - - - - - - - - Snyk test report - - - - - - - - - -
      -
      -
      -
      - - - Snyk - Open Source Security - - - - - - - -
      -

      Snyk test report

      - -

      July 2nd 2023, 12:23:56 am (UTC+00:00)

      -
      -
      - Scanned the following paths: -
        -
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (apk)
      • ghcr.io/dexidp/dex:v2.36.0/hairyhenderson/gomplate/v3 (gomodules)
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
        • -
      -
      - -
      -
      5 known vulnerabilities
      -
      35 vulnerable dependency paths
      -
      760 dependencies
      -
      -
      -
      -
      - -
      -
      -
      -

      Improper Certificate Validation

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      A security vulnerability has been identified in all supported versions

      -

      of OpenSSL related to the verification of X.509 certificate chains - that include policy constraints. Attackers may be able to exploit this - vulnerability by creating a malicious certificate chain that triggers - exponential use of computational resources, leading to a denial-of-service - (DoS) attack on affected systems.

      -

      Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r1 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Allocation of Resources Without Limits or Throttling

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Issue summary: Processing some specially crafted ASN.1 object identifiers or - data containing them may be very slow.

      -

      Impact summary: Applications that use OBJ_obj2txt() directly, or use any of - the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message - size limit may experience notable to very long delays when processing those - messages, which may lead to a Denial of Service.

      -

      An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - - most of which have no size limit. OBJ_obj2txt() may be used to translate - an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL - type ASN1_OBJECT) to its canonical numeric text form, which are the - sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by - periods.

      -

      When one of the sub-identifiers in the OBJECT IDENTIFIER is very large - (these are sizes that are seen as absurdly large, taking up tens or hundreds - of KiBs), the translation to a decimal number in text may take a very long - time. The time complexity is O(n^2) with 'n' being the size of the - sub-identifiers in bytes (*).

      -

      With OpenSSL 3.0, support to fetch cryptographic algorithms using names / - identifiers in string form was introduced. This includes using OBJECT - IDENTIFIERs in canonical numeric text form as identifiers for fetching - algorithms.

      -

      Such OBJECT IDENTIFIERs may be received through the ASN.1 structure - AlgorithmIdentifier, which is commonly used in multiple protocols to specify - what cryptographic algorithm should be used to sign or verify, encrypt or - decrypt, or digest passed data.

      -

      Applications that call OBJ_obj2txt() directly with untrusted data are - affected, with any version of OpenSSL. If the use is for the mere purpose - of display, the severity is considered low.

      -

      In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, - CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 - certificates, including simple things like verifying its signature.

      -

      The impact on TLS is relatively low, because all versions of OpenSSL have a - 100KiB limit on the peer's certificate chain. Additionally, this only - impacts clients, or servers that have explicitly enabled client - authentication.

      -

      In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, - such as X.509 certificates. This is assumed to not happen in such a way - that it would cause a Denial of Service, so these versions are considered - not affected by this issue in such a way that it would be cause for concern, - and the severity is therefore considered low.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.9-r0 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Improper Certificate Validation

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Applications that use a non-default option when verifying certificates may be - vulnerable to an attack from a malicious CA to circumvent certain checks.

      -

      Invalid certificate policies in leaf certificates are silently ignored by - OpenSSL and other certificate policy checks are skipped for that certificate. - A malicious CA could use this to deliberately assert invalid certificate policies - in order to circumvent policy checking on the certificate altogether.

      -

      Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r2 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Improper Certificate Validation

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      The function X509_VERIFY_PARAM_add0_policy() is documented to - implicitly enable the certificate policy check when doing certificate - verification. However the implementation of the function does not - enable the check which allows certificates with invalid or incorrect - policies to pass the certificate verification.

      -

      As suddenly enabling the policy check could break existing deployments it was - decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() - function.

      -

      Instead the applications that require OpenSSL to perform certificate - policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly - enable the policy check by calling X509_VERIFY_PARAM_set_flags() with - the X509_V_FLAG_POLICY_CHECK flag argument.

      -

      Certificate policy checks are disabled by default in OpenSSL and are not - commonly used by applications.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Out-of-bounds Read

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM - platform contains a bug that could cause it to read past the input buffer, - leading to a crash.

      -

      Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM - platform can crash in rare circumstances. The AES-XTS algorithm is usually - used for disk encryption.

      -

      The AES-XTS cipher decryption implementation for 64 bit ARM platform will read - past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 - byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext - buffer is unmapped, this will trigger a crash which results in a denial of - service.

      -

      If an attacker can control the size and location of the ciphertext buffer - being decrypted by an application using AES-XTS on 64 bit ARM, the - application is affected. This is fairly unlikely making this issue - a Low severity one.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r4 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -
      -
      - - - diff --git a/docs/snyk/v2.7.6/argocd-iac-install.html b/docs/snyk/v2.7.7/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.7.6/argocd-iac-install.html rename to docs/snyk/v2.7.7/argocd-iac-install.html index d7eb84a2be15a..4e2362297bc40 100644 --- a/docs/snyk/v2.7.6/argocd-iac-install.html +++ b/docs/snyk/v2.7.7/argocd-iac-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:25:56 am (UTC+00:00)

      +

      July 9th 2023, 12:28:09 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.7.6/argocd-iac-namespace-install.html b/docs/snyk/v2.7.7/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.7.6/argocd-iac-namespace-install.html rename to docs/snyk/v2.7.7/argocd-iac-namespace-install.html index e6a49f2ba894b..4b29fa86b708d 100644 --- a/docs/snyk/v2.7.6/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.7.7/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:26:13 am (UTC+00:00)

      +

      July 9th 2023, 12:28:22 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.7.6/argocd-test.html b/docs/snyk/v2.7.7/argocd-test.html similarity index 98% rename from docs/snyk/v2.7.6/argocd-test.html rename to docs/snyk/v2.7.7/argocd-test.html index cb72215111ca5..2c6423ddd2fff 100644 --- a/docs/snyk/v2.7.6/argocd-test.html +++ b/docs/snyk/v2.7.7/argocd-test.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:23:49 am (UTC+00:00)

      +

      July 9th 2023, 12:24:52 am (UTC+00:00)

      Scanned the following paths: @@ -468,7 +468,7 @@

      Snyk test report

      1 known vulnerabilities
      1 vulnerable dependency paths
      -
      1749 dependencies
      +
      1748 dependencies
      @@ -476,12 +476,12 @@

      Snyk test report

      -
      +

      Regular Expression Denial of Service (ReDoS)

      -
      - medium severity +
      + high severity
      diff --git a/docs/snyk/v2.7.7/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.7.7/ghcr.io_dexidp_dex_v2.37.0.html new file mode 100644 index 0000000000000..45783f437da31 --- /dev/null +++ b/docs/snyk/v2.7.7/ghcr.io_dexidp_dex_v2.37.0.html @@ -0,0 +1,483 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
      +
      +
      +
      + + + Snyk - Open Source Security + + + + + + + +
      +

      Snyk test report

      + +

      July 9th 2023, 12:25:00 am (UTC+00:00)

      +
      +
      + Scanned the following paths: +
        +
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (apk)
      • ghcr.io/dexidp/dex:v2.37.0/hairyhenderson/gomplate/v3 (gomodules)
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
        • +
      +
      + +
      +
      0 known vulnerabilities
      +
      0 vulnerable dependency paths
      +
      786 dependencies
      +
      +
      +
      +
      + +
      + No known vulnerabilities detected. +
      +
      + + + diff --git a/docs/snyk/v2.8.0-rc1/haproxy_2.6.14-alpine.html b/docs/snyk/v2.7.7/haproxy_2.6.14-alpine.html similarity index 99% rename from docs/snyk/v2.8.0-rc1/haproxy_2.6.14-alpine.html rename to docs/snyk/v2.7.7/haproxy_2.6.14-alpine.html index 33cf8ed39e9ee..1345240936aa0 100644 --- a/docs/snyk/v2.8.0-rc1/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.7.7/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:20:40 am (UTC+00:00)

      +

      July 9th 2023, 12:25:05 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.6.11/quay.io_argoproj_argocd_v2.6.11.html b/docs/snyk/v2.7.7/quay.io_argoproj_argocd_v2.7.7.html similarity index 83% rename from docs/snyk/v2.6.11/quay.io_argoproj_argocd_v2.6.11.html rename to docs/snyk/v2.7.7/quay.io_argoproj_argocd_v2.7.7.html index 5ff33dd067dd3..7d94f50a4ec52 100644 --- a/docs/snyk/v2.6.11/quay.io_argoproj_argocd_v2.6.11.html +++ b/docs/snyk/v2.7.7/quay.io_argoproj_argocd_v2.7.7.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

      Snyk test report

      -

      July 2nd 2023, 12:27:17 am (UTC+00:00)

      +

      July 9th 2023, 12:26:27 am (UTC+00:00)

      Scanned the following paths:
        -
      • quay.io/argoproj/argocd:v2.6.11/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.6.11/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.6.11/kustomize/kustomize/v4 (gomodules)
      • quay.io/argoproj/argocd:v2.6.11/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.6.11/git-lfs/git-lfs (gomodules)
        • +
      • quay.io/argoproj/argocd:v2.7.7/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.7.7/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.7.7/kustomize/kustomize/v5 (gomodules)
      • quay.io/argoproj/argocd:v2.7.7/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.7.7/git-lfs/git-lfs (gomodules)
      -
      25 known vulnerabilities
      -
      74 vulnerable dependency paths
      -
      2064 dependencies
      +
      22 known vulnerabilities
      +
      96 vulnerable dependency paths
      +
      2066 dependencies
      @@ -493,12 +493,12 @@

      Denial of Service (DoS)

    • Vulnerable module: - gopkg.in/yaml.v3 + golang.org/x/net/http2/hpack
    • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* and gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b + helm.sh/helm/v3@* and golang.org/x/net/http2/hpack@v0.5.0
    @@ -511,9 +511,9 @@

    Detailed paths

    • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* + helm.sh/helm/v3@* › - gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b + golang.org/x/net/http2/hpack@v0.5.0 @@ -525,20 +525,7 @@

      Detailed paths

      Overview

      -

      gopkg.in/yaml.v3 is a YAML support package for the Go language.

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS) via the Unmarshal function, which causes the program to crash when attempting to deserialize invalid input.

      -

      PoC

      - 
      package main
-        
-        import (
-            "gopkg.in/yaml.v3"
-        )
-        
-        func main() {
-            var t interface{}
-            yaml.Unmarshal([]byte("0: [:!00 \xef"), &t)
-        }
-
      +

      Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

      Details

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      @@ -552,95 +539,19 @@

      Details

    Remediation

    -

    Upgrade gopkg.in/yaml.v3 to version 3.0.0 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    NULL Pointer Dereference

    -
    - -
    - high severity -
    - -
    - -
      -
    • - Package Manager: golang -
      • -
    • - Vulnerable module: - - gopkg.in/yaml.v3 -
      • - -
    • Introduced through: - - sigs.k8s.io/kustomize/kustomize/v4@* and gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* - › - gopkg.in/yaml.v3@v3.0.0-20210107192922-496545a6307b - - - -
      • -
    - -
    - -
    - -

    Overview

    -

    gopkg.in/yaml.v3 is a YAML support package for the Go language.

    -

    Affected versions of this package are vulnerable to NULL Pointer Dereference when parsing #\n-\n-\n0 via the parserc.go parser.

    -

    PoC

    - 
    package main
-        
-        import (
-            "gopkg.in/yaml.v3"
-        )
-        
-        func main() {
-            var t interface{}
-            yaml.Unmarshal([]byte("#\n-\n-\n0"), &t)
-        }
-
    -

    Remediation

    -

    Upgrade gopkg.in/yaml.v3 to version 3.0.1 or higher.

    +

    Upgrade golang.org/x/net/http2/hpack to version 0.7.0 or higher.

    References

    -

    More about this vulnerability

    +

    More about this vulnerability

    @@ -661,12 +572,12 @@

    Denial of Service (DoS)

  • Vulnerable module: - golang.org/x/net/http2/hpack + golang.org/x/net/http2
  • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* and golang.org/x/net/http2/hpack@v0.0.0-20220127200216-cd36cc0744dd + helm.sh/helm/v3@* and golang.org/x/net/http2@v0.5.0
    • @@ -677,20 +588,11 @@

    Denial of Service (DoS)

    Detailed paths

      -
    • - Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* - › - golang.org/x/net/http2/hpack@v0.0.0-20220127200216-cd36cc0744dd - - - -
    • Introduced through: helm.sh/helm/v3@* › - golang.org/x/net/http2/hpack@v0.0.0-20220722155237-a158d28d115b + golang.org/x/net/http2@v0.5.0 @@ -702,6 +604,7 @@

      Detailed paths

      Overview

      +

      golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

      Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

      Details

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      @@ -716,7 +619,7 @@

      Details

    Remediation

    -

    Upgrade golang.org/x/net/http2/hpack to version 0.7.0 or higher.

    +

    Upgrade golang.org/x/net/http2 to version 0.7.0 or higher.

    References

    -
    -

    Denial of Service

    +
    +

    Improper Validation of Integrity Check Value

    -
    - high severity +
    + medium severity
    • - Package Manager: golang + Package Manager: ubuntu:22.04
    • Vulnerable module: - golang.org/x/net/http2 + systemd/libsystemd0
    • Introduced through: - helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + docker-image|quay.io/argoproj/argocd@v2.7.7 and systemd/libsystemd0@249.11-0ubuntu3.9
    @@ -767,75 +670,110 @@

    Detailed paths

    • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.7.7 › - golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + systemd/libsystemd0@249.11-0ubuntu3.9
      • -
    - -
    - -
    - -

    Overview

    -

    golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

    -

    Affected versions of this package are vulnerable to Denial of Service as an HTTP/2 connection can hang during closing if a shutdown was preempted by a fatal error.

    -

    Remediation

    -

    Upgrade golang.org/x/net/http2 to version 0.0.0-20220906165146-f3363e06e74c, 1.18.6, 1.19.1 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Denial of Service (DoS)

    -
    - -
    - high severity -
    - -
    - -
      -
    • - Package Manager: golang -
      • -
    • - Vulnerable module: +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + - golang.org/x/net/http2 -
      • + +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + -
    • Introduced through: +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + - helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + -
      • -
    + +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + -
    +
    • +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + systemd/libudev1@249.11-0ubuntu3.9 + + +
    • +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + -

    Detailed paths

    +
    • +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + -
      +
    • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 › - golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + systemd/libudev1@249.11-0ubuntu3.9 @@ -846,40 +784,29 @@

      Detailed paths

      -

      Overview

      -

      golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

      -

      Details

      -

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      -

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      -

      One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

      -

      When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

      -

      Two common types of DoS vulnerabilities:

      -
        -

      • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

        -
        • -

      • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

        -
        • -
      +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      +

      ** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

      Remediation

      -

      Upgrade golang.org/x/net/http2 to version 0.7.0 or higher.

      +

      There is no fixed version for Ubuntu:22.04 systemd.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    • -

    Improper Input Validation

    +

    Improper Validation of Integrity Check Value

    @@ -890,17 +817,17 @@

    Improper Input Validation

    • - Package Manager: golang + Package Manager: ubuntu:22.04
    • Vulnerable module: - golang.org/x/text/language + systemd/libsystemd0
    • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* and golang.org/x/text/language@v0.3.7 + docker-image|quay.io/argoproj/argocd@v2.7.7 and systemd/libsystemd0@249.11-0ubuntu3.9
    @@ -913,18 +840,110 @@

    Detailed paths

    • Introduced through: - sigs.k8s.io/kustomize/kustomize/v4@* + docker-image|quay.io/argoproj/argocd@v2.7.7 › - golang.org/x/text/language@v0.3.7 + systemd/libsystemd0@249.11-0ubuntu3.9
    • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 › - golang.org/x/text/language@v0.3.7 + systemd/libudev1@249.11-0ubuntu3.9 @@ -935,28 +954,29 @@

      Detailed paths

      -

      Overview

      -

      Affected versions of this package are vulnerable to Improper Input Validation due to the parser being, by design, exposed to untrusted user input, which can be leveraged to force a program to consume significant time parsing Accept-Language headers.

      +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      +

      ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

      Remediation

      -

      Upgrade golang.org/x/text/language to version 0.3.8 or higher.

      +

      There is no fixed version for Ubuntu:22.04 systemd.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    -

    Incorrect Privilege Assignment

    +

    Improper Validation of Integrity Check Value

    @@ -967,17 +987,17 @@

    Incorrect Privilege Assignment

    • - Package Manager: golang + Package Manager: ubuntu:22.04
    • Vulnerable module: - golang.org/x/sys/unix + systemd/libsystemd0
    • Introduced through: - helm.sh/helm/v3@* and golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f + docker-image|quay.io/argoproj/argocd@v2.7.7 and systemd/libsystemd0@249.11-0ubuntu3.9
    @@ -990,74 +1010,110 @@

    Detailed paths

    • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.7.7 › - golang.org/x/sys/unix@v0.0.0-20220722155257-8c9f86f7a55f + systemd/libsystemd0@249.11-0ubuntu3.9
      • -
    - -
    - -
    - -

    Overview

    -

    Affected versions of this package are vulnerable to Incorrect Privilege Assignment such that when called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible.

    -

    Remediation

    -

    Upgrade golang.org/x/sys/unix to version 0.1.0 or higher.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    - -
    -
    -

    Denial of Service (DoS)

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Package Manager: golang -
      • -
    • - Vulnerable module: +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + - golang.org/x/net/http2 -
      • + +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + -
    • Introduced through: +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + - helm.sh/helm/v3@* and golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + -
      • -
    + +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + -
    +
    • +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + systemd/libudev1@249.11-0ubuntu3.9 + + +
    • +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + -

    Detailed paths

    +
    • +
  • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.7.7 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + -
      +
    • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.7.7 › - golang.org/x/net/http2@v0.0.0-20220722155237-a158d28d115b + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 @@ -1068,35 +1124,24 @@

      Detailed paths

      -

      Overview

      -

      golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper checks and limitations for the number of entries in the cache, which can allow an attacker to consume unbounded amounts of memory by sending a small number of very large keys.

      -

      Details

      -

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      -

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      -

      One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

      -

      When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

      -

      Two common types of DoS vulnerabilities:

      -
        -

      • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

        -
        • -

      • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

        -
        • -
      +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      +

      ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

      Remediation

      -

      Upgrade golang.org/x/net/http2 to version 0.4.0 or higher.

      +

      There is no fixed version for Ubuntu:22.04 systemd.

      References

      -

      More about this vulnerability

      +

      More about this vulnerability

    • @@ -1123,7 +1168,7 @@

    CVE-2022-46908

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11, gnupg2/gpg@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.7.7, gnupg2/gpg@2.2.27-3ubuntu2.1 and others
    • @@ -1135,7 +1180,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -1194,7 +1239,7 @@

      Arbitrary Code Injection

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and shadow/passwd@1:4.8.1-2ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and shadow/passwd@1:4.8.1-2ubuntu2.1
    @@ -1207,7 +1252,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › shadow/passwd@1:4.8.1-2ubuntu2.1 @@ -1216,7 +1261,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › adduser@3.118ubuntu5 › @@ -1227,7 +1272,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -1238,7 +1283,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › shadow/login@1:4.8.1-2ubuntu2.1 @@ -1295,7 +1340,7 @@

      Uncontrolled Recursion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    @@ -1308,7 +1353,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 @@ -1317,7 +1362,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › grep@3.7-1build1 › @@ -1379,7 +1424,7 @@

      Release of Invalid Pointer or Reference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.7.7 and patch@2.7.6-7build2
    @@ -1392,7 +1437,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › patch@2.7.6-7build2 @@ -1446,7 +1491,7 @@

      Double Free

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.7.7 and patch@2.7.6-7build2
    @@ -1459,7 +1504,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › patch@2.7.6-7build2 @@ -1518,7 +1563,7 @@

      Information Exposure

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1531,7 +1576,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1592,7 +1637,7 @@

      CVE-2023-28531

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1605,7 +1650,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1661,7 +1706,7 @@

      NULL Pointer Dereference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.7.7, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others
    @@ -1673,7 +1718,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -1684,7 +1729,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 › @@ -1697,7 +1742,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › openldap/libldap-common@2.5.14+dfsg-0ubuntu0.22.04.2 @@ -1721,6 +1766,7 @@

      References

    • ADVISORY
    • secalert@redhat.com
    • secalert@redhat.com
      • +
    • secalert@redhat.com
    @@ -1753,7 +1799,7 @@

    Resource Exhaustion

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11, meta-common-packages@meta and others + docker-image|quay.io/argoproj/argocd@v2.7.7, meta-common-packages@meta and others
    • @@ -1765,7 +1811,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › meta-common-packages@meta › @@ -1821,7 +1867,7 @@

      Integer Overflow or Wraparound

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.7.7 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -1834,7 +1880,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › krb5/libk5crypto3@1.19.2-2ubuntu0.2 @@ -1843,7 +1889,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › adduser@3.118ubuntu5 › @@ -1864,7 +1910,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › adduser@3.118ubuntu5 › @@ -1887,7 +1933,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › krb5/libkrb5-3@1.19.2-2ubuntu0.2 @@ -1896,7 +1942,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › adduser@3.118ubuntu5 › @@ -1917,7 +1963,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -1926,7 +1972,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -1937,7 +1983,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 › @@ -1950,7 +1996,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 › @@ -1965,7 +2011,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › adduser@3.118ubuntu5 › @@ -1984,7 +2030,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › meta-common-packages@meta › @@ -2043,7 +2089,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and gnupg2/gpgv@2.2.27-3ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and gnupg2/gpgv@2.2.27-3ubuntu2.1
    @@ -2056,7 +2102,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpgv@2.2.27-3ubuntu2.1 @@ -2065,7 +2111,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › apt@2.4.9 › @@ -2076,7 +2122,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2087,7 +2133,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -2098,7 +2144,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -2109,7 +2155,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2122,7 +2168,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2135,7 +2181,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 @@ -2144,7 +2190,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2155,7 +2201,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2168,7 +2214,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1 @@ -2177,7 +2223,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2188,7 +2234,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 @@ -2197,7 +2243,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2208,7 +2254,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpg@2.2.27-3ubuntu2.1 @@ -2217,7 +2263,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2228,7 +2274,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2241,7 +2287,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2254,7 +2300,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 @@ -2263,7 +2309,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2274,7 +2320,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2287,7 +2333,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2300,7 +2346,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 @@ -2309,7 +2355,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2320,7 +2366,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 @@ -2329,7 +2375,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2340,7 +2386,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 @@ -2349,7 +2395,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -2360,7 +2406,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › gnupg2/gnupg@2.2.27-3ubuntu2.1 @@ -2419,7 +2465,7 @@

      Allocation of Resources Without Limits or Throttling

      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and glibc/libc-bin@2.35-0ubuntu3.1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and glibc/libc-bin@2.35-0ubuntu3.1
    @@ -2432,7 +2478,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › glibc/libc-bin@2.35-0ubuntu3.1 @@ -2441,7 +2487,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › meta-common-packages@meta › @@ -2500,7 +2546,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.7.7, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2512,7 +2558,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 › @@ -2523,7 +2569,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 @@ -2532,7 +2578,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git-lfs@3.0.2-1ubuntu0.2 › @@ -2590,7 +2636,7 @@

      CVE-2023-28322

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.7.7, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2602,7 +2648,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 › @@ -2662,7 +2708,7 @@

      Improper Certificate Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.7.7, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2674,7 +2720,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › git@1:2.34.1-1ubuntu1.9 › @@ -2733,7 +2779,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and coreutils@8.32-4.1ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and coreutils@8.32-4.1ubuntu1
    @@ -2746,7 +2792,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › coreutils@8.32-4.1ubuntu1 @@ -2803,7 +2849,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 and bash@5.1-6ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.7.7 and bash@5.1-6ubuntu1
    @@ -2816,7 +2862,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.6.11 + docker-image|quay.io/argoproj/argocd@v2.7.7 › bash@5.1-6ubuntu1 diff --git a/docs/snyk/v2.6.11/redis_7.0.11-alpine.html b/docs/snyk/v2.7.7/redis_7.0.11-alpine.html similarity index 99% rename from docs/snyk/v2.6.11/redis_7.0.11-alpine.html rename to docs/snyk/v2.7.7/redis_7.0.11-alpine.html index 27ade985cb25c..af32078a9160b 100644 --- a/docs/snyk/v2.6.11/redis_7.0.11-alpine.html +++ b/docs/snyk/v2.7.7/redis_7.0.11-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:27:20 am (UTC+00:00)

      +

      July 9th 2023, 12:26:32 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.8.0-rc1/ghcr.io_dexidp_dex_v2.36.0.html b/docs/snyk/v2.8.0-rc1/ghcr.io_dexidp_dex_v2.36.0.html deleted file mode 100644 index 6ed24f39c464b..0000000000000 --- a/docs/snyk/v2.8.0-rc1/ghcr.io_dexidp_dex_v2.36.0.html +++ /dev/null @@ -1,1245 +0,0 @@ - - - - - - - - - Snyk test report - - - - - - - - - -
      -
      -
      -
      - - - Snyk - Open Source Security - - - - - - - -
      -

      Snyk test report

      - -

      July 2nd 2023, 12:20:36 am (UTC+00:00)

      -
      -
      - Scanned the following paths: -
        -
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (apk)
      • ghcr.io/dexidp/dex:v2.36.0/hairyhenderson/gomplate/v3 (gomodules)
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
      • ghcr.io/dexidp/dex:v2.36.0/dexidp/dex (gomodules)
        • -
      -
      - -
      -
      5 known vulnerabilities
      -
      35 vulnerable dependency paths
      -
      760 dependencies
      -
      -
      -
      -
      - -
      -
      -
      -

      Improper Certificate Validation

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      A security vulnerability has been identified in all supported versions

      -

      of OpenSSL related to the verification of X.509 certificate chains - that include policy constraints. Attackers may be able to exploit this - vulnerability by creating a malicious certificate chain that triggers - exponential use of computational resources, leading to a denial-of-service - (DoS) attack on affected systems.

      -

      Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r1 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Allocation of Resources Without Limits or Throttling

      -
      - -
      - high severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Issue summary: Processing some specially crafted ASN.1 object identifiers or - data containing them may be very slow.

      -

      Impact summary: Applications that use OBJ_obj2txt() directly, or use any of - the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message - size limit may experience notable to very long delays when processing those - messages, which may lead to a Denial of Service.

      -

      An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - - most of which have no size limit. OBJ_obj2txt() may be used to translate - an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL - type ASN1_OBJECT) to its canonical numeric text form, which are the - sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by - periods.

      -

      When one of the sub-identifiers in the OBJECT IDENTIFIER is very large - (these are sizes that are seen as absurdly large, taking up tens or hundreds - of KiBs), the translation to a decimal number in text may take a very long - time. The time complexity is O(n^2) with 'n' being the size of the - sub-identifiers in bytes (*).

      -

      With OpenSSL 3.0, support to fetch cryptographic algorithms using names / - identifiers in string form was introduced. This includes using OBJECT - IDENTIFIERs in canonical numeric text form as identifiers for fetching - algorithms.

      -

      Such OBJECT IDENTIFIERs may be received through the ASN.1 structure - AlgorithmIdentifier, which is commonly used in multiple protocols to specify - what cryptographic algorithm should be used to sign or verify, encrypt or - decrypt, or digest passed data.

      -

      Applications that call OBJ_obj2txt() directly with untrusted data are - affected, with any version of OpenSSL. If the use is for the mere purpose - of display, the severity is considered low.

      -

      In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, - CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 - certificates, including simple things like verifying its signature.

      -

      The impact on TLS is relatively low, because all versions of OpenSSL have a - 100KiB limit on the peer's certificate chain. Additionally, this only - impacts clients, or servers that have explicitly enabled client - authentication.

      -

      In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, - such as X.509 certificates. This is assumed to not happen in such a way - that it would cause a Denial of Service, so these versions are considered - not affected by this issue in such a way that it would be cause for concern, - and the severity is therefore considered low.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.9-r0 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Improper Certificate Validation

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Applications that use a non-default option when verifying certificates may be - vulnerable to an attack from a malicious CA to circumvent certain checks.

      -

      Invalid certificate policies in leaf certificates are silently ignored by - OpenSSL and other certificate policy checks are skipped for that certificate. - A malicious CA could use this to deliberately assert invalid certificate policies - in order to circumvent policy checking on the certificate altogether.

      -

      Policy processing is disabled by default but can be enabled by passing - the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r2 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Improper Certificate Validation

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      The function X509_VERIFY_PARAM_add0_policy() is documented to - implicitly enable the certificate policy check when doing certificate - verification. However the implementation of the function does not - enable the check which allows certificates with invalid or incorrect - policies to pass the certificate verification.

      -

      As suddenly enabling the policy check could break existing deployments it was - decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() - function.

      -

      Instead the applications that require OpenSSL to perform certificate - policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly - enable the policy check by calling X509_VERIFY_PARAM_set_flags() with - the X509_V_FLAG_POLICY_CHECK flag argument.

      -

      Certificate policy checks are disabled by default in OpenSSL and are not - commonly used by applications.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r3 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Out-of-bounds Read

      -
      - -
      - medium severity -
      - -
      - -
        -
      • - Package Manager: alpine:3.17 -
        • -
      • - Vulnerable module: - - openssl/libcrypto3 -
        • - -
      • Introduced through: - - docker-image|ghcr.io/dexidp/dex@v2.36.0 and openssl/libcrypto3@3.0.8-r0 - -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libcrypto3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - apk-tools/apk-tools@2.12.10-r1 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      • - Introduced through: - docker-image|ghcr.io/dexidp/dex@v2.36.0 - › - busybox/ssl_client@1.35.0-r29 - › - openssl/libssl3@3.0.8-r0 - - - -
        • -
      - -
      - -
      - -

      NVD Description

      -

      Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine:3.17. - See How to fix? for Alpine:3.17 relevant fixed versions and status.

      -

      Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM - platform contains a bug that could cause it to read past the input buffer, - leading to a crash.

      -

      Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM - platform can crash in rare circumstances. The AES-XTS algorithm is usually - used for disk encryption.

      -

      The AES-XTS cipher decryption implementation for 64 bit ARM platform will read - past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 - byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext - buffer is unmapped, this will trigger a crash which results in a denial of - service.

      -

      If an attacker can control the size and location of the ciphertext buffer - being decrypted by an application using AES-XTS on 64 bit ARM, the - application is affected. This is fairly unlikely making this issue - a Low severity one.

      -

      Remediation

      -

      Upgrade Alpine:3.17 openssl to version 3.0.8-r4 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -
      -
      - - - diff --git a/docs/snyk/v2.8.0-rc1/argocd-iac-install.html b/docs/snyk/v2.8.0-rc2/argocd-iac-install.html similarity index 99% rename from docs/snyk/v2.8.0-rc1/argocd-iac-install.html rename to docs/snyk/v2.8.0-rc2/argocd-iac-install.html index 187a2d975fc7b..37e7c7ae3112a 100644 --- a/docs/snyk/v2.8.0-rc1/argocd-iac-install.html +++ b/docs/snyk/v2.8.0-rc2/argocd-iac-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:23:13 am (UTC+00:00)

      +

      July 9th 2023, 12:24:16 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.8.0-rc1/argocd-iac-namespace-install.html b/docs/snyk/v2.8.0-rc2/argocd-iac-namespace-install.html similarity index 99% rename from docs/snyk/v2.8.0-rc1/argocd-iac-namespace-install.html rename to docs/snyk/v2.8.0-rc2/argocd-iac-namespace-install.html index a1a0edc53e66c..47cd7fe47ef63 100644 --- a/docs/snyk/v2.8.0-rc1/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.8.0-rc2/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:23:26 am (UTC+00:00)

      +

      July 9th 2023, 12:24:30 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.8.0-rc1/argocd-test.html b/docs/snyk/v2.8.0-rc2/argocd-test.html similarity index 99% rename from docs/snyk/v2.8.0-rc1/argocd-test.html rename to docs/snyk/v2.8.0-rc2/argocd-test.html index 7964e7fc0dc93..3504db482b43b 100644 --- a/docs/snyk/v2.8.0-rc1/argocd-test.html +++ b/docs/snyk/v2.8.0-rc2/argocd-test.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:20:28 am (UTC+00:00)

      +

      July 9th 2023, 12:21:45 am (UTC+00:00)

      Scanned the following paths: @@ -477,7 +477,7 @@

      Snyk test report

      -

      Denial of Service (DoS)

      +

      Regular Expression Denial of Service (ReDoS)

      @@ -486,88 +486,6 @@

      Denial of Service (DoS)

      -
        -
      • - Package Manager: golang -
        • -
      • - Vulnerable module: - - nhooyr.io/websocket -
        • - -
      • Introduced through: - - - github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others -
        • -
      - -
      - - -

      Detailed paths

      - -
        -
      • - Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0 - › - github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 - › - nhooyr.io/websocket@1.8.6 - - - -
        • -
      - -
      - -
      - -

      Overview

      -

      nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping. - If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would - occur.

      -

      Details

      -

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      -

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      -

      One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

      -

      When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

      -

      Two common types of DoS vulnerabilities:

      -
        -

      • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

        -
        • -

      • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

        -
        • -
      -

      Remediation

      -

      Upgrade nhooyr.io/websocket to version 1.8.7 or higher.

      -

      References

      - - -
      - -
      -

      More about this vulnerability

      -
      - -
      -
      -

      Regular Expression Denial of Service (ReDoS)

      -
      - -
      - medium severity -
      - -
      -
      • Package Manager: npm @@ -708,6 +626,88 @@

        References

      +
      +

      Denial of Service (DoS)

      +
      + +
      + high severity +
      + +
      + +
        +
      • + Package Manager: golang +
        • +
      • + Vulnerable module: + + nhooyr.io/websocket +
        • + +
      • Introduced through: + + + github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others +
        • +
      + +
      + + +

      Detailed paths

      + +
        +
      • + Introduced through: + github.com/argoproj/argo-cd/v2@0.0.0 + › + github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 + › + nhooyr.io/websocket@1.8.6 + + + +
        • +
      + +
      + +
      + +

      Overview

      +

      nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.

      +

      Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping. + If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would + occur.

      +

      Details

      +

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      +

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      +

      One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

      +

      When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

      +

      Two common types of DoS vulnerabilities:

      +
        +

      • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

        +
        • +

      • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

        +
        • +
      +

      Remediation

      +

      Upgrade nhooyr.io/websocket to version 1.8.7 or higher.

      +

      References

      + + +
      + +
      +

      More about this vulnerability

      +
      + +
      diff --git a/docs/snyk/v2.8.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html b/docs/snyk/v2.8.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html new file mode 100644 index 0000000000000..f563be4c1dbf5 --- /dev/null +++ b/docs/snyk/v2.8.0-rc2/ghcr.io_dexidp_dex_v2.37.0.html @@ -0,0 +1,483 @@ + + + + + + + + + Snyk test report + + + + + + + + + +
      +
      +
      +
      + + + Snyk - Open Source Security + + + + + + + +
      +

      Snyk test report

      + +

      July 9th 2023, 12:21:56 am (UTC+00:00)

      +
      +
      + Scanned the following paths: +
        +
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (apk)
      • ghcr.io/dexidp/dex:v2.37.0/hairyhenderson/gomplate/v3 (gomodules)
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
      • ghcr.io/dexidp/dex:v2.37.0/dexidp/dex (gomodules)
        • +
      +
      + +
      +
      0 known vulnerabilities
      +
      0 vulnerable dependency paths
      +
      786 dependencies
      +
      +
      +
      +
      + +
      + No known vulnerabilities detected. +
      +
      + + + diff --git a/docs/snyk/v2.6.11/haproxy_2.6.14-alpine.html b/docs/snyk/v2.8.0-rc2/haproxy_2.6.14-alpine.html similarity index 99% rename from docs/snyk/v2.6.11/haproxy_2.6.14-alpine.html rename to docs/snyk/v2.8.0-rc2/haproxy_2.6.14-alpine.html index ee7a50490c4df..08faa4d358f3a 100644 --- a/docs/snyk/v2.6.11/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.8.0-rc2/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:26:45 am (UTC+00:00)

      +

      July 9th 2023, 12:22:00 am (UTC+00:00)

      Scanned the following path: diff --git a/docs/snyk/v2.7.6/quay.io_argoproj_argocd_v2.7.6.html b/docs/snyk/v2.8.0-rc2/quay.io_argoproj_argocd_v2.8.0-rc2.html similarity index 77% rename from docs/snyk/v2.7.6/quay.io_argoproj_argocd_v2.7.6.html rename to docs/snyk/v2.8.0-rc2/quay.io_argoproj_argocd_v2.8.0-rc2.html index f8f23f274f5a4..3517f43e60638 100644 --- a/docs/snyk/v2.7.6/quay.io_argoproj_argocd_v2.7.6.html +++ b/docs/snyk/v2.8.0-rc2/quay.io_argoproj_argocd_v2.8.0-rc2.html @@ -7,7 +7,7 @@ Snyk test report - + @@ -456,19 +456,19 @@

      Snyk test report

      -

      July 2nd 2023, 12:24:25 am (UTC+00:00)

      +

      July 9th 2023, 12:22:24 am (UTC+00:00)

      Scanned the following paths:
        -
      • quay.io/argoproj/argocd:v2.7.6/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.7.6/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.7.6/kustomize/kustomize/v5 (gomodules)
      • quay.io/argoproj/argocd:v2.7.6/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.7.6/git-lfs/git-lfs (gomodules)
        • +
      • quay.io/argoproj/argocd:v2.8.0-rc2/argoproj/argocd (deb)
      • quay.io/argoproj/argocd:v2.8.0-rc2/argoproj/argo-cd/v2 (gomodules)
      • quay.io/argoproj/argocd:v2.8.0-rc2/kustomize/kustomize/v5 (gomodules)
      • quay.io/argoproj/argocd:v2.8.0-rc2/helm/v3 (gomodules)
      • quay.io/argoproj/argocd:v2.8.0-rc2/git-lfs/git-lfs (gomodules)
      -
      19 known vulnerabilities
      -
      66 vulnerable dependency paths
      -
      2066 dependencies
      +
      21 known vulnerabilities
      +
      95 vulnerable dependency paths
      +
      2112 dependencies
      @@ -493,12 +493,12 @@

      Denial of Service (DoS)

    • Vulnerable module: - golang.org/x/net/http2/hpack + nhooyr.io/websocket
    • Introduced through: - helm.sh/helm/v3@* and golang.org/x/net/http2/hpack@v0.5.0 + github.com/argoproj/argo-cd/v2@* and nhooyr.io/websocket@v1.8.6
    @@ -511,9 +511,9 @@

    Detailed paths

    • Introduced through: - helm.sh/helm/v3@* + github.com/argoproj/argo-cd/v2@* › - golang.org/x/net/http2/hpack@v0.5.0 + nhooyr.io/websocket@v1.8.6 @@ -525,7 +525,10 @@

      Detailed paths

      Overview

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

      +

      nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.

      +

      Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping. + If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would + occur.

      Details

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      @@ -539,45 +542,43 @@

      Details

    Remediation

    -

    Upgrade golang.org/x/net/http2/hpack to version 0.7.0 or higher.

    +

    Upgrade nhooyr.io/websocket to version 1.8.7 or higher.

    References

    -

    More about this vulnerability

    +

    More about this vulnerability

    -
    -

    Denial of Service (DoS)

    +
    +

    Improper Validation of Integrity Check Value

    -
    - high severity +
    + medium severity
    • - Package Manager: golang + Package Manager: ubuntu:22.04
    • Vulnerable module: - golang.org/x/net/http2 + systemd/libsystemd0
    • Introduced through: - helm.sh/helm/v3@* and golang.org/x/net/http2@v0.5.0 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and systemd/libsystemd0@249.11-0ubuntu3.9
    @@ -590,9 +591,110 @@

    Detailed paths

    • Introduced through: - helm.sh/helm/v3@* + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 › - golang.org/x/net/http2@v0.5.0 + systemd/libudev1@249.11-0ubuntu3.9 @@ -603,35 +705,364 @@

      Detailed paths

      -

      Overview

      -

      golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

      -

      Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.

      -

      Details

      -

      Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

      -

      Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

      -

      One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

      -

      When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

      -

      Two common types of DoS vulnerabilities:

      +

      NVD Description

      +

      Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

      +

      ** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

      +

      Remediation

      +

      There is no fixed version for Ubuntu:22.04 systemd.

      +

      References

      + +
      + +
      +

      More about this vulnerability

      +
      + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    + +
    +
    +

    Improper Validation of Integrity Check Value

    +
    + +
    + medium severity +
    + +
    + +
      +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + systemd/libsystemd0 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and systemd/libsystemd0@249.11-0ubuntu3.9 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + procps/libprocps8@2:3.3.17-6ubuntu2 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux/bsdutils@1:2.37.2-4ubuntu3 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libsystemd0@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + libfido2/libfido2-1@1.10.0-1 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + util-linux@2.37.2-4ubuntu3 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 + › + apt@2.4.9 + › + apt/libapt-pkg6.0@2.4.9 + › + systemd/libudev1@249.11-0ubuntu3.9 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu:22.04. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

    Remediation

    -

    Upgrade golang.org/x/net/http2 to version 0.7.0 or higher.

    +

    There is no fixed version for Ubuntu:22.04 systemd.

    References

    -

    More about this vulnerability

    +

    More about this vulnerability

    @@ -658,7 +1089,7 @@

    CVE-2022-46908

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6, gnupg2/gpg@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2, gnupg2/gpg@2.2.27-3ubuntu2.1 and others
    • @@ -670,7 +1101,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -729,7 +1160,7 @@

      Arbitrary Code Injection

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and shadow/passwd@1:4.8.1-2ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and shadow/passwd@1:4.8.1-2ubuntu2.1
    @@ -742,7 +1173,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › shadow/passwd@1:4.8.1-2ubuntu2.1 @@ -751,7 +1182,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › adduser@3.118ubuntu5 › @@ -762,7 +1193,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -773,7 +1204,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › shadow/login@1:4.8.1-2ubuntu2.1 @@ -830,7 +1261,7 @@

      Uncontrolled Recursion

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
    @@ -843,7 +1274,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1 @@ -852,7 +1283,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › grep@3.7-1build1 › @@ -914,7 +1345,7 @@

      Release of Invalid Pointer or Reference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and patch@2.7.6-7build2
    @@ -927,7 +1358,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › patch@2.7.6-7build2 @@ -981,7 +1412,7 @@

      Double Free

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and patch@2.7.6-7build2 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and patch@2.7.6-7build2
    @@ -994,7 +1425,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › patch@2.7.6-7build2 @@ -1053,7 +1484,7 @@

      Information Exposure

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1066,7 +1497,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1127,7 +1558,7 @@

      CVE-2023-28531

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and openssh/openssh-client@1:8.9p1-3ubuntu0.1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and openssh/openssh-client@1:8.9p1-3ubuntu0.1
    @@ -1140,7 +1571,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 @@ -1196,7 +1627,7 @@

      NULL Pointer Dereference

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2, gnupg2/dirmngr@2.2.27-3ubuntu2.1 and others
    @@ -1208,7 +1639,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -1219,7 +1650,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 › @@ -1232,7 +1663,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › openldap/libldap-common@2.5.14+dfsg-0ubuntu0.22.04.2 @@ -1256,6 +1687,7 @@

      References

    • ADVISORY
    • secalert@redhat.com
    • secalert@redhat.com
      • +
    • secalert@redhat.com
    @@ -1288,7 +1720,7 @@

    Resource Exhaustion

  • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6, meta-common-packages@meta and others + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2, meta-common-packages@meta and others
    • @@ -1300,7 +1732,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › meta-common-packages@meta › @@ -1356,7 +1788,7 @@

      Integer Overflow or Wraparound

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and krb5/libk5crypto3@1.19.2-2ubuntu0.2 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and krb5/libk5crypto3@1.19.2-2ubuntu0.2
    @@ -1369,7 +1801,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › krb5/libk5crypto3@1.19.2-2ubuntu0.2 @@ -1378,7 +1810,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › adduser@3.118ubuntu5 › @@ -1399,7 +1831,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › adduser@3.118ubuntu5 › @@ -1422,7 +1854,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › krb5/libkrb5-3@1.19.2-2ubuntu0.2 @@ -1431,7 +1863,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › adduser@3.118ubuntu5 › @@ -1452,7 +1884,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2 @@ -1461,7 +1893,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › openssh/openssh-client@1:8.9p1-3ubuntu0.1 › @@ -1472,7 +1904,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 › @@ -1485,7 +1917,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 › @@ -1500,7 +1932,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › adduser@3.118ubuntu5 › @@ -1519,7 +1951,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › meta-common-packages@meta › @@ -1578,7 +2010,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and gnupg2/gpgv@2.2.27-3ubuntu2.1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and gnupg2/gpgv@2.2.27-3ubuntu2.1
    @@ -1591,7 +2023,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpgv@2.2.27-3ubuntu2.1 @@ -1600,7 +2032,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › apt@2.4.9 › @@ -1611,7 +2043,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1622,7 +2054,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › @@ -1633,7 +2065,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpg@2.2.27-3ubuntu2.1 › @@ -1644,7 +2076,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1657,7 +2089,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1670,7 +2102,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/dirmngr@2.2.27-3ubuntu2.1 @@ -1679,7 +2111,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1690,7 +2122,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1703,7 +2135,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1 @@ -1712,7 +2144,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1723,7 +2155,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 @@ -1732,7 +2164,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1743,7 +2175,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpg@2.2.27-3ubuntu2.1 @@ -1752,7 +2184,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1763,7 +2195,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1776,7 +2208,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1789,7 +2221,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 @@ -1798,7 +2230,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1809,7 +2241,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1822,7 +2254,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1835,7 +2267,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 @@ -1844,7 +2276,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1855,7 +2287,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 @@ -1864,7 +2296,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1875,7 +2307,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 @@ -1884,7 +2316,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 › @@ -1895,7 +2327,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › gnupg2/gnupg@2.2.27-3ubuntu2.1 @@ -1954,7 +2386,7 @@

      Allocation of Resources Without Limits or Throttling

      Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and glibc/libc-bin@2.35-0ubuntu3.1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and glibc/libc-bin@2.35-0ubuntu3.1
    @@ -1967,7 +2399,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › glibc/libc-bin@2.35-0ubuntu3.1 @@ -1976,7 +2408,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › meta-common-packages@meta › @@ -2035,7 +2467,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2047,7 +2479,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 › @@ -2058,7 +2490,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 @@ -2067,7 +2499,7 @@

      Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git-lfs@3.0.2-1ubuntu0.2 › @@ -2125,7 +2557,7 @@

      CVE-2023-28322

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2137,7 +2569,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 › @@ -2197,7 +2629,7 @@

      Improper Certificate Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6, git@1:2.34.1-1ubuntu1.9 and others + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2, git@1:2.34.1-1ubuntu1.9 and others
    @@ -2209,7 +2641,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › git@1:2.34.1-1ubuntu1.9 › @@ -2268,7 +2700,7 @@

      Improper Input Validation

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and coreutils@8.32-4.1ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and coreutils@8.32-4.1ubuntu1
    @@ -2281,7 +2713,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › coreutils@8.32-4.1ubuntu1 @@ -2338,7 +2770,7 @@

      Out-of-bounds Write

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 and bash@5.1-6ubuntu1 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 and bash@5.1-6ubuntu1
    @@ -2351,7 +2783,7 @@

    Detailed paths

    • Introduced through: - docker-image|quay.io/argoproj/argocd@v2.7.6 + docker-image|quay.io/argoproj/argocd@v2.8.0-rc2 › bash@5.1-6ubuntu1 diff --git a/docs/snyk/v2.8.0-rc1/redis_7.0.11-alpine.html b/docs/snyk/v2.8.0-rc2/redis_7.0.11-alpine.html similarity index 99% rename from docs/snyk/v2.8.0-rc1/redis_7.0.11-alpine.html rename to docs/snyk/v2.8.0-rc2/redis_7.0.11-alpine.html index 259513420ca13..6252a53e5bebf 100644 --- a/docs/snyk/v2.8.0-rc1/redis_7.0.11-alpine.html +++ b/docs/snyk/v2.8.0-rc2/redis_7.0.11-alpine.html @@ -456,7 +456,7 @@

      Snyk test report

      -

      July 2nd 2023, 12:21:40 am (UTC+00:00)

      +

      July 9th 2023, 12:22:28 am (UTC+00:00)

      Scanned the following path: From 3b496ceca92d12ebf3fd3015cb3e8748e8ee8e4c Mon Sep 17 00:00:00 2001 From: Alex Collins Date: Sun, 9 Jul 2023 11:17:27 -0700 Subject: [PATCH 03/17] fix: Fix pod log viewer scrollbars (#14199) * fix: Fix pod log viewer scrollbars Signed-off-by: Alex Collins * fix scrolling Signed-off-by: Alex Collins --------- Signed-off-by: Alex Collins --- .../pod-logs-viewer/pod-logs-viewer.tsx | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx b/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx index 79f8a854c2def..72629d306e902 100644 --- a/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx +++ b/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx @@ -8,7 +8,7 @@ import {LogEntry} from '../../../shared/models'; import {services, ViewPreferences} from '../../../shared/services'; import AutoSizer from 'react-virtualized/dist/commonjs/AutoSizer'; -import List from 'react-virtualized/dist/commonjs/List'; +import Grid from 'react-virtualized/dist/commonjs/Grid'; import './pod-logs-viewer.scss'; import {CopyLogsButton} from './copy-logs-button'; @@ -26,6 +26,7 @@ import {TailSelector} from './tail-selector'; import {PodNamesToggleButton} from './pod-names-toggle-button'; import Ansi from 'ansi-to-react'; import {AutoScrollButton} from './auto-scroll-button'; +import {GridCellProps} from 'react-virtualized/dist/es/Grid'; export interface PodLogsProps { namespace: string; @@ -133,14 +134,22 @@ export const PodsLogsViewer = (props: PodLogsProps) => { // show the log content, highlight the filter text log.content?.replace(highlight, (substring: string) => whiteOnYellow + substring + reset); - const rowRenderer = ({index, key, style}: {index: number; key: string; style: React.CSSProperties}) => { + const cellRenderer = ({rowIndex, key, style}: GridCellProps) => { return ( 
      -                {renderLog(logs[index], index)}
+                {renderLog(logs[rowIndex], rowIndex)}
      ); }; + // calculate the width of the grid based on the longest log line + const maxWidth = + 14 * + logs + .map(renderLog) + .map(v => v.length) + .reduce((a, b) => Math.max(a, b), 0); + return ( services.viewPreferences.getPreferences()}> {(prefs: ViewPreferences) => { @@ -178,18 +187,19 @@ export const PodsLogsViewer = (props: PodLogsProps) => {
      { - if (e.deltaY !== 0) setScrollToBottom(false); + if (e.deltaY < 0) setScrollToBottom(false); }}> {({width, height}: {width: number; height: number}) => ( - <>No logs} - scrollToIndex={scrollToBottom ? logs.length - 1 : undefined} + scrollToRow={scrollToBottom ? logs.length - 1 : undefined} /> )} From 1209ef2e5b8268cb6f1e7f86ead7762270620360 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Jul 2023 12:25:46 -0400 Subject: [PATCH 04/17] chore(deps): bump docker/setup-buildx-action from 2.8.0 to 2.9.0 (#14423) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.8.0 to 2.9.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a...2a1a44ac4aa01993040736bd95bb470da1a38365) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/image-reuse.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/image-reuse.yaml b/.github/workflows/image-reuse.yaml index 6abd84f4d33b2..9cd200f0b51b6 100644 --- a/.github/workflows/image-reuse.yaml +++ b/.github/workflows/image-reuse.yaml @@ -79,7 +79,7 @@ jobs: cosign-release: 'v2.0.0' - uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0 - - uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a # v2.8.0 + - uses: docker/setup-buildx-action@2a1a44ac4aa01993040736bd95bb470da1a38365 # v2.9.0 - name: Setup tags for container image as a CSV type run: | From 7c5c72cedb87c9e235f01a86c8b1ca77a92f996f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Jul 2023 12:26:11 -0400 Subject: [PATCH 05/17] chore(deps): bump github.com/aws/aws-sdk-go from 1.44.297 to 1.44.298 (#14425) Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.44.297 to 1.44.298. - [Release notes](https://github.com/aws/aws-sdk-go/releases) - [Commits](https://github.com/aws/aws-sdk-go/compare/v1.44.297...v1.44.298) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8b46df13cfcb1..94437d3427379 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/argoproj/gitops-engine v0.7.1-0.20230607163028-425d65e07695 github.com/argoproj/notifications-engine v0.4.1-0.20230620204159-3446d4ae8520 github.com/argoproj/pkg v0.13.7-0.20230626144333-d56162821bd1 - github.com/aws/aws-sdk-go v1.44.297 + github.com/aws/aws-sdk-go v1.44.298 github.com/bmatcuk/doublestar/v4 v4.6.0 github.com/bombsimon/logrusr/v2 v2.0.1 github.com/bradleyfalzon/ghinstallation/v2 v2.5.0 diff --git a/go.sum b/go.sum index f4206eb49e149..9c1315e2d479c 100644 --- a/go.sum +++ b/go.sum @@ -716,8 +716,8 @@ github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN github.com/aws/aws-sdk-go v1.35.24/go.mod h1:tlPOdRjfxPBpNIwqDj61rmsnA85v9jc0Ps9+muhnW+k= github.com/aws/aws-sdk-go v1.38.49/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro= github.com/aws/aws-sdk-go v1.44.289/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= -github.com/aws/aws-sdk-go v1.44.297 h1:uL4EV0gQxotQVYegIoBqK079328MOJqgG95daFYSkAM= -github.com/aws/aws-sdk-go v1.44.297/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= +github.com/aws/aws-sdk-go v1.44.298 h1:5qTxdubgV7PptZJmp/2qDwD2JL187ePL7VOxsSh1i3g= +github.com/aws/aws-sdk-go v1.44.298/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g= github.com/beevik/ntp v0.2.0/go.mod h1:hIHWr+l3+/clUnF44zdK+CWW7fO8dR5cIylAQ76NRpg= github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM= From ddb0d10946c42703e2787ffd6d571748e8b1e349 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Jul 2023 14:05:46 -0400 Subject: [PATCH 06/17] chore(deps): bump tough-cookie from 4.0.0 to 4.1.3 in /ui (#14417) Bumps [tough-cookie](https://github.com/salesforce/tough-cookie) from 4.0.0 to 4.1.3. - [Release notes](https://github.com/salesforce/tough-cookie/releases) - [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md) - [Commits](https://github.com/salesforce/tough-cookie/compare/v4.0.0...v4.1.3) --- updated-dependencies: - dependency-name: tough-cookie dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- ui/yarn.lock | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/ui/yarn.lock b/ui/yarn.lock index 7a1c55b970860..c930f4f62200e 100644 --- a/ui/yarn.lock +++ b/ui/yarn.lock @@ -7299,6 +7299,11 @@ querystring@0.2.0: resolved "https://registry.yarnpkg.com/querystring/-/querystring-0.2.0.tgz#b209849203bb25df820da756e747005878521620" integrity sha1-sgmEkgO7Jd+CDadW50cAWHhSFiA= +querystringify@^2.1.1: + version "2.2.0" + resolved "https://registry.yarnpkg.com/querystringify/-/querystringify-2.2.0.tgz#3345941b4153cb9d082d8eee4cda2016a9aef7f6" + integrity sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ== + queue-microtask@^1.2.2: version "1.2.3" resolved "https://registry.yarnpkg.com/queue-microtask/-/queue-microtask-1.2.3.tgz#4929228bbc724dfac43e0efb058caf7b6cfb6243" @@ -9257,13 +9262,14 @@ toidentifier@1.0.1: integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA== tough-cookie@^4.0.0: - version "4.0.0" - resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-4.0.0.tgz#d822234eeca882f991f0f908824ad2622ddbece4" - integrity sha512-tHdtEpQCMrc1YLrMaqXXcj6AxhYi/xgit6mZu1+EDWUn+qhUf8wMQoFIy9NXuq23zAwtcB0t/MjACGR18pcRbg== + version "4.1.3" + resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-4.1.3.tgz#97b9adb0728b42280aa3d814b6b999b2ff0318bf" + integrity sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw== dependencies: psl "^1.1.33" punycode "^2.1.1" - universalify "^0.1.2" + universalify "^0.2.0" + url-parse "^1.5.3" tr46@^2.1.0: version "2.1.0" @@ -9486,10 +9492,10 @@ unique-slug@^2.0.0: dependencies: imurmurhash "^0.1.4" -universalify@^0.1.2: - version "0.1.2" - resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.1.2.tgz#b646f69be3942dabcecc9d6639c80dc105efaa66" - integrity sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg== +universalify@^0.2.0: + version "0.2.0" + resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.2.0.tgz#6451760566fa857534745ab1dde952d1b1761be0" + integrity sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg== unpipe@1.0.0, unpipe@~1.0.0: version "1.0.0" @@ -9516,6 +9522,14 @@ urix@^0.1.0: resolved "https://registry.yarnpkg.com/urix/-/urix-0.1.0.tgz#da937f7a62e21fec1fd18d49b35c2935067a6c72" integrity sha1-2pN/emLiH+wf0Y1Js1wpNQZ6bHI= +url-parse@^1.5.3: + version "1.5.10" + resolved "https://registry.yarnpkg.com/url-parse/-/url-parse-1.5.10.tgz#9d3c2f736c1d75dd3bd2be507dcc111f1e2ea9c1" + integrity sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ== + dependencies: + querystringify "^2.1.1" + requires-port "^1.0.0" + url-template@^2.0.8: version "2.0.8" resolved "https://registry.yarnpkg.com/url-template/-/url-template-2.0.8.tgz#fc565a3cccbff7730c775f5641f9555791439f21" From 0cf31fb9c9e54ce9c6ff8f906ca91d29cc793691 Mon Sep 17 00:00:00 2001 From: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Date: Mon, 10 Jul 2023 14:08:54 -0400 Subject: [PATCH 07/17] chore: add more logging for when RBAC enforcement fails (#14406) Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --- server/rbacpolicy/rbacpolicy.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/rbacpolicy/rbacpolicy.go b/server/rbacpolicy/rbacpolicy.go index 6d039dcdd6246..940f5bfe70844 100644 --- a/server/rbacpolicy/rbacpolicy.go +++ b/server/rbacpolicy/rbacpolicy.go @@ -3,7 +3,7 @@ package rbacpolicy import ( "strings" - jwt "github.com/golang-jwt/jwt/v4" + "github.com/golang-jwt/jwt/v4" log "github.com/sirupsen/logrus" "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" @@ -154,7 +154,7 @@ func (p *RBACPolicyEnforcer) EnforceClaims(claims jwt.Claims, rvals ...interface } } } - logCtx := log.WithField("claims", claims).WithField("rval", rvals) + logCtx := log.WithFields(log.Fields{"claims": claims, "rval": rvals, "subject": subject, "groups": groups, "project": projName, "scopes": scopes}) logCtx.Debug("enforce failed") return false } From 056424928f71236ac9628b3e87505402758a5aea Mon Sep 17 00:00:00 2001 From: Aryan <75756768+aynp@users.noreply.github.com> Date: Tue, 11 Jul 2023 04:03:40 +0530 Subject: [PATCH 08/17] chore: Replace `os.Getenv("HOME")` with `os.UserHomeDir()` (#12850) (#14325) * Replace `os.Getenv("HOME")` with `os.UserHomeDir()` `os.UserHomeDir()` is the recommended way of getting user home directory Signed-off-by: Aryan Pathania * Retrigger CI pipeline Signed-off-by: Aryan Pathania --------- Signed-off-by: Aryan Pathania --- pkg/apis/application/v1alpha1/types.go | 7 ++++++- util/localconfig/localconfig.go | 14 +++++--------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/pkg/apis/application/v1alpha1/types.go b/pkg/apis/application/v1alpha1/types.go index b957fbe7ffa5b..cae6b16052174 100644 --- a/pkg/apis/application/v1alpha1/types.go +++ b/pkg/apis/application/v1alpha1/types.go @@ -2859,7 +2859,12 @@ func (c *Cluster) RawRestConfig() *rest.Config { if exists { config, err = clientcmd.BuildConfigFromFlags("", conf) } else { - config, err = clientcmd.BuildConfigFromFlags("", filepath.Join(os.Getenv("HOME"), ".kube", "config")) + var homeDir string + homeDir, err = os.UserHomeDir() + if err != nil { + homeDir = "" + } + config, err = clientcmd.BuildConfigFromFlags("", filepath.Join(homeDir, ".kube", "config")) } } else if c.Server == KubernetesInternalAPIServerAddr && c.Config.Username == "" && c.Config.Password == "" && c.Config.BearerToken == "" { config, err = rest.InClusterConfig() diff --git a/util/localconfig/localconfig.go b/util/localconfig/localconfig.go index 1a3828e240702..7f91ebbb05454 100644 --- a/util/localconfig/localconfig.go +++ b/util/localconfig/localconfig.go @@ -2,12 +2,12 @@ package localconfig import ( "fmt" - "github.com/golang-jwt/jwt/v4" "os" - "os/user" "path" "strings" + "github.com/golang-jwt/jwt/v4" + configUtil "github.com/argoproj/argo-cd/v2/util/config" ) @@ -281,14 +281,10 @@ func DefaultConfigDir() (string, error) { } func getHomeDir() (string, error) { - homeDir := os.Getenv("HOME") - if homeDir == "" { - usr, err := user.Current() - if err != nil { - return "", err - } + homeDir, err := os.UserHomeDir() - homeDir = usr.HomeDir + if err != nil { + return "", err } return homeDir, nil From faaa302fac9605f1cb0f3a11c1eadb3cd27eea40 Mon Sep 17 00:00:00 2001 From: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Date: Tue, 11 Jul 2023 08:04:32 -0400 Subject: [PATCH 09/17] fix(action): copy metadata on create-job action (#14232) (#14233) Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --- .../batch/CronJob/actions/create-job/action.lua | 6 +++++- .../batch/CronJob/actions/testdata/cronjob.yaml | 10 ++++++++++ .../batch/CronJob/actions/testdata/job.yaml | 9 +++++++++ 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/resource_customizations/batch/CronJob/actions/create-job/action.lua b/resource_customizations/batch/CronJob/actions/create-job/action.lua index 119e0d35eccb6..17b6455fa3d5d 100644 --- a/resource_customizations/batch/CronJob/actions/create-job/action.lua +++ b/resource_customizations/batch/CronJob/actions/create-job/action.lua @@ -32,7 +32,10 @@ job = {} job.apiVersion = "batch/v1" job.kind = "Job" -job.metadata = {} +job.metadata = deepCopy(obj.spec.jobTemplate.metadata) +if job.metadata == nil then + job.metadata = {} +end job.metadata.name = obj.metadata.name .. "-" ..os.date("!%Y%m%d%H%M") job.metadata.namespace = obj.metadata.namespace @@ -47,6 +50,7 @@ job.metadata.ownerReferences[1] = ownerRef job.spec = {} job.spec.suspend = false job.spec.template = {} +job.spec.template.metadata = deepCopy(obj.spec.jobTemplate.spec.template.metadata) job.spec.template.spec = deepCopy(obj.spec.jobTemplate.spec.template.spec) impactedResource = {} diff --git a/resource_customizations/batch/CronJob/actions/testdata/cronjob.yaml b/resource_customizations/batch/CronJob/actions/testdata/cronjob.yaml index 118fc83929e96..d422c82da393a 100644 --- a/resource_customizations/batch/CronJob/actions/testdata/cronjob.yaml +++ b/resource_customizations/batch/CronJob/actions/testdata/cronjob.yaml @@ -7,8 +7,18 @@ metadata: spec: schedule: "* * * * *" jobTemplate: + metadata: + labels: + my: label + annotations: + my: annotation spec: template: + metadata: + labels: + pod: label + annotations: + pod: annotation spec: containers: - name: hello diff --git a/resource_customizations/batch/CronJob/actions/testdata/job.yaml b/resource_customizations/batch/CronJob/actions/testdata/job.yaml index cf0f92da24818..16d4e4960b0dc 100644 --- a/resource_customizations/batch/CronJob/actions/testdata/job.yaml +++ b/resource_customizations/batch/CronJob/actions/testdata/job.yaml @@ -5,8 +5,17 @@ metadata: name: hello-00000000000 namespace: test-ns + labels: + my: label + annotations: + my: annotation spec: template: + metadata: + labels: + pod: label + annotations: + pod: annotation spec: containers: - name: hello From 5953cc2b59d4342b0f451fbd3a635ed430ef794e Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Tue, 11 Jul 2023 07:53:40 -0700 Subject: [PATCH 10/17] docs: Update SLSA verification commands (#14437) * update Signed-off-by: laurentsimon * update Signed-off-by: laurentsimon * update Signed-off-by: laurentsimon * update Signed-off-by: laurentsimon * update Signed-off-by: laurentsimon * update Signed-off-by: laurentsimon * update Signed-off-by: laurentsimon --------- Signed-off-by: laurentsimon --- docs/operator-manual/signed-release-assets.md | 68 +++++++++++++++---- 1 file changed, 54 insertions(+), 14 deletions(-) diff --git a/docs/operator-manual/signed-release-assets.md b/docs/operator-manual/signed-release-assets.md index 57cd7e7cd4fcd..4944f70ac1cb8 100644 --- a/docs/operator-manual/signed-release-assets.md +++ b/docs/operator-manual/signed-release-assets.md @@ -3,6 +3,7 @@ ## Prerequisites - cosign `v2.0.0` or higher [installation instructions](https://docs.sigstore.dev/cosign/installation) - slsa-verifier [installation instructions](https://github.com/slsa-framework/slsa-verifier#installation) +- crane [installation instructions](https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md) (for container verification only) *** ## Release Assets @@ -60,40 +61,79 @@ The following checks were performed on each of these signatures: ``` *** -## Verification of container image attestations +## Verification of container image with SLSA attestations A [SLSA](https://slsa.dev/) Level 3 provenance is generated using [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator). The following command will verify the signature of an attestation and how it was issued. It will contain the payloadType, payload, and signature. + +Run the following command as per the [slsa-verifier documentation](https://github.com/slsa-framework/slsa-verifier/tree/main#containers): + ```bash -cosign verify-attestation --type slsaprovenance \ ---certificate-identity-regexp https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v \ ---certificate-oidc-issuer https://token.actions.githubusercontent.com \ -quay.io/argoproj/argocd:v2.7.0 | jq +# Get the immutable container image to prevent TOCTOU attacks https://github.com/slsa-framework/slsa-verifier#toctou-attacks +IMAGE=quay.io/argoproj/argocd:v2.7.0 +IMAGE="${IMAGE}@"$(crane digest "${IMAGE}") +# Verify provenance, including the tag to prevent rollback attacks. +slsa-verifier verify-image "$IMAGE" \ + --source-uri github.com/argoproj/argo-cd \ + --source-tag v2.7.0 +``` + +If you only want to verify up to the major or minor verion of the source repository tag (instead of the full tag), use the `--source-versioned-tag` which performs semantic versioning verification: + +```shell +slsa-verifier verify-image "$IMAGE" \ + --source-uri github.com/argoproj/argo-cd \ + --source-versioned-tag v2 # Note: May use v2.7 for minor version verification. ``` -The payload is a non-falsifiable provenance which is base64 encoded and can be viewed by using the command below: + +The attestation payload contains a non-forgeable provenance which is base64 encoded and can be viewed by passing the `--print-provenance` option to the commands above: + ```bash -cosign verify-attestation --type slsaprovenance \ ---certificate-identity-regexp https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v \ ---certificate-oidc-issuer https://token.actions.githubusercontent.com \ -quay.io/argoproj/argocd:v2.7.0 | jq -r .payload | base64 -d | jq +slsa-verifier verify-image "$IMAGE" \ + --source-uri github.com/argoproj/argo-cd \ + --source-tag v2.7.0 + --print-provenance | jq ``` + +If you prefer using cosign, follow these [instructions](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#cosign). + !!! tip `cosign` or `slsa-verifier` can both be used to verify image attestations. Check the documentation of each binary for detailed instructions. *** -## Verification of CLI artifacts with attestations + +## Verification of CLI artifacts with SLSA attestations A single attestation (`argocd-cli.intoto.jsonl`) from each release is provided. This can be used with [slsa-verifier](https://github.com/slsa-framework/slsa-verifier#verification-for-github-builders) to verify that a CLI binary was generated using Argo CD workflows on GitHub and ensures it was cryptographically signed. + ```bash -slsa-verifier verify-artifact argocd-linux-amd64 --provenance-path argocd-cli.intoto.jsonl --source-uri github.com/argoproj/argo-cd +slsa-verifier verify-artifact argocd-linux-amd64 \ + --provenance-path argocd-cli.intoto.jsonl \ + --source-uri github.com/argoproj/argo-cd \ + --source-tag v2.7.0 ``` -## Verifying an artifact and output the provenance + +If you only want to verify up to the major or minor verion of the source repository tag (instead of the full tag), use the `--source-versioned-tag` which performs semantic versioning verification: + +```shell +slsa-verifier verify-artifact argocd-linux-amd64 \ + --provenance-path argocd-cli.intoto.jsonl \ + --source-uri github.com/argoproj/argo-cd \ + --source-versioned-tag v2 # Note: May use v2.7 for minor version verification. +``` + +The payload is a non-forgeable provenance which is base64 encoded and can be viewed by passing the `--print-provenance` option to the commands above: ```bash -slsa-verifier verify-artifact argocd-linux-amd64 --provenance-path argocd-cli.intoto.jsonl --source-uri github.com/argoproj/argo-cd --print-provenance | jq +slsa-verifier verify-artifact argocd-linux-amd64 \ + --provenance-path argocd-cli.intoto.jsonl \ + --source-uri github.com/argoproj/argo-cd \ + --source-tag v2.7.0 \ + --print-provenance | jq ``` + ## Verification of Sbom ```bash From 6a9f4c4fef25d26a610fb919a36216db211736d3 Mon Sep 17 00:00:00 2001 From: fsl <1171313930@qq.com> Date: Tue, 11 Jul 2023 23:09:44 +0800 Subject: [PATCH 11/17] chore(deps): bump library/node from 20.3.1 to 20.4.0 (#14450) Signed-off-by: fengshunli <1171313930@qq.com> --- .github/workflows/ci-build.yaml | 2 +- Dockerfile | 2 +- test/container/Dockerfile | 2 +- ui-test/Dockerfile | 2 +- ui/.nvmrc | 2 +- ui/package.json | 2 +- ui/yarn.lock | 8 ++++---- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml index a7410e550bef8..43afc73bcb24c 100644 --- a/.github/workflows/ci-build.yaml +++ b/.github/workflows/ci-build.yaml @@ -267,7 +267,7 @@ jobs: - name: Setup NodeJS uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 with: - node-version: '20.3.1' + node-version: '20.4.0' - name: Restore node dependency cache id: cache-dependencies uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 diff --git a/Dockerfile b/Dockerfile index 12c9ea8f4e6da..dbed21ca65bad 100644 --- a/Dockerfile +++ b/Dockerfile @@ -83,7 +83,7 @@ WORKDIR /home/argocd #################################################################################################### # Argo CD UI stage #################################################################################################### -FROM --platform=$BUILDPLATFORM docker.io/library/node:20.3.1@sha256:2f0b0c15f97441defa812268ee943bbfaaf666ea6cf7cac62ee3f127906b35c6 AS argocd-ui +FROM --platform=$BUILDPLATFORM docker.io/library/node:20.4.0@sha256:b3ca7d32f0c12291df6e45a914d4ee60011a3fce4a978df5e609e356a4a2cb88 AS argocd-ui WORKDIR /src COPY ["ui/package.json", "ui/yarn.lock", "./"] diff --git a/test/container/Dockerfile b/test/container/Dockerfile index 373505ee3ef5a..d6ae93e26884b 100644 --- a/test/container/Dockerfile +++ b/test/container/Dockerfile @@ -6,7 +6,7 @@ FROM docker.io/library/redis:7.0.11@sha256:f50031a49f41e493087fb95f96fdb3523bb25 RUN ln -s /usr/lib/$(uname -m)-linux-gnu /usr/lib/linux-gnu # Please make sure to also check the contained yarn version and update the references below when upgrading this image's version -FROM docker.io/library/node:20.3.1@sha256:2f0b0c15f97441defa812268ee943bbfaaf666ea6cf7cac62ee3f127906b35c6 as node +FROM docker.io/library/node:20.4.0@sha256:b3ca7d32f0c12291df6e45a914d4ee60011a3fce4a978df5e609e356a4a2cb88 as node FROM docker.io/library/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f as golang diff --git a/ui-test/Dockerfile b/ui-test/Dockerfile index e3ed314621d5c..567917399b33b 100644 --- a/ui-test/Dockerfile +++ b/ui-test/Dockerfile @@ -1,4 +1,4 @@ -FROM docker.io/library/node:20.3.1@sha256:2f0b0c15f97441defa812268ee943bbfaaf666ea6cf7cac62ee3f127906b35c6 AS node +FROM docker.io/library/node:20.4.0@sha256:b3ca7d32f0c12291df6e45a914d4ee60011a3fce4a978df5e609e356a4a2cb88 as node RUN apt-get update && apt-get install --no-install-recommends -y \ software-properties-common diff --git a/ui/.nvmrc b/ui/.nvmrc index 04f4e7ab35f38..a79492b06865b 100644 --- a/ui/.nvmrc +++ b/ui/.nvmrc @@ -1 +1 @@ -v20.3.1 +v20.4.0 diff --git a/ui/package.json b/ui/package.json index 497b0d04a0f85..5321920ef8e33 100644 --- a/ui/package.json +++ b/ui/package.json @@ -77,7 +77,7 @@ "@types/js-yaml": "^3.11.2", "@types/lodash-es": "^4.17.6", "@types/minimatch": "^3.0.3", - "@types/node": "20.3.1", + "@types/node": "20.4.0", "@types/prop-types": "^15.7.5", "@types/react": "^16.8.5", "@types/react-autocomplete": "^1.8.4", diff --git a/ui/yarn.lock b/ui/yarn.lock index c930f4f62200e..d82e6ea715563 100644 --- a/ui/yarn.lock +++ b/ui/yarn.lock @@ -1908,10 +1908,10 @@ resolved "https://registry.yarnpkg.com/@types/node/-/node-16.3.1.tgz#24691fa2b0c3ec8c0d34bfcfd495edac5593ebb4" integrity sha512-N87VuQi7HEeRJkhzovao/JviiqKjDKMVKxKMfUvSKw+MbkbW8R0nA3fi/MQhhlxV2fQ+2ReM+/Nt4efdrJx3zA== -"@types/node@20.3.1": - version "20.3.1" - resolved "https://registry.yarnpkg.com/@types/node/-/node-20.3.1.tgz#e8a83f1aa8b649377bb1fb5d7bac5cb90e784dfe" - integrity sha512-EhcH/wvidPy1WeML3TtYFGR83UzjxeWRen9V402T8aUGYsCHOmfoisV3ZSg03gAFIbLq8TnWOJ0f4cALtnSEUg== +"@types/node@20.4.0": + version "20.4.0" + resolved "https://registry.yarnpkg.com/@types/node/-/node-20.4.0.tgz#01d637d1891e419bc85763b46f42809cd2d5addb" + integrity sha512-jfT7iTf/4kOQ9S7CHV9BIyRaQqHu67mOjsIQBC3BKZvzvUB6zLxEwJ6sBE3ozcvP8kF6Uk5PXN0Q+c0dfhGX0g== "@types/node@^14.11.8": version "14.18.12" From 6fb238c7d8b05e38b1ec25aaa4eb354be31d57ee Mon Sep 17 00:00:00 2001 From: Ishita Sequeira <46771830+ishitasequeira@users.noreply.github.com> Date: Tue, 11 Jul 2023 11:34:29 -0400 Subject: [PATCH 12/17] feat(appset): Add support for self-signed TLS / Certificates for Gitlab Scm Provider (#14348) * Add support for self-signed TLS / Certificates for Gitlab Scm Provider Signed-off-by: ishitasequeira * Add support for self-signed TLS / Certificates for Gitlab Pull Request Signed-off-by: ishitasequeira * Add TLS configuration for SCM and Pull request Gitlab Provider Signed-off-by: ishitasequeira * rebase with master Signed-off-by: ishitasequeira * add params to argocd-cmd-params-cm and docs Signed-off-by: ishitasequeira * fix generated manifests Signed-off-by: ishitasequeira * Address comments for docs Signed-off-by: ishitasequeira * Add test cases to validate insecure mode and ca cert combinations Signed-off-by: ishitasequeira * simplify (#24) Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --------- Signed-off-by: ishitasequeira Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Co-authored-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --- .../controllers/applicationset_controller.go | 1 + .../applicationset_controller_test.go | 5 +- .../controllers/requeue_after_test.go | 11 +- applicationset/generators/cluster.go | 3 +- applicationset/generators/duck_type_test.go | 3 +- .../generators/generator_spec_processor.go | 3 +- .../generator_spec_processor_test.go | 3 +- applicationset/generators/list.go | 3 +- applicationset/generators/pull_request.go | 10 +- applicationset/generators/scm_provider.go | 6 +- .../services/pull_request/gitlab.go | 13 +- .../services/pull_request/gitlab_test.go | 10 +- .../services/scm_provider/gitlab.go | 15 +- .../services/scm_provider/gitlab_test.go | 14 +- applicationset/utils/utils.go | 38 + applicationset/utils/utils_test.go | 92 ++ applicationset/webhook/webhook_test.go | 3 +- assets/swagger.json | 8 + .../commands/applicationset_controller.go | 7 +- .../Add-self-signed-TLS-Certs.md | 9 + .../applicationset/Generators-Pull-Request.md | 5 + .../applicationset/Generators-SCM-Provider.md | 5 + .../operator-manual/argocd-cmd-params-cm.yaml | 2 + ...-applicationset-controller-deployment.yaml | 6 + manifests/core-install.yaml | 18 + manifests/crds/applicationset-crd.yaml | 12 + manifests/ha/install.yaml | 18 + manifests/ha/namespace-install.yaml | 6 + manifests/install.yaml | 18 + manifests/namespace-install.yaml | 6 + .../v1alpha1/applicationset_types.go | 4 + pkg/apis/application/v1alpha1/generated.pb.go | 1384 +++++++++-------- pkg/apis/application/v1alpha1/generated.proto | 6 + .../application/v1alpha1/openapi_generated.go | 14 + 34 files changed, 1060 insertions(+), 701 deletions(-) create mode 100644 docs/operator-manual/applicationset/Add-self-signed-TLS-Certs.md diff --git a/applicationset/controllers/applicationset_controller.go b/applicationset/controllers/applicationset_controller.go index 245262fe184ac..d785ad7289c4a 100644 --- a/applicationset/controllers/applicationset_controller.go +++ b/applicationset/controllers/applicationset_controller.go @@ -86,6 +86,7 @@ type ApplicationSetReconciler struct { ArgoCDNamespace string ApplicationSetNamespaces []string EnableProgressiveSyncs bool + SCMRootCAPath string } // +kubebuilder:rbac:groups=argoproj.io,resources=applicationsets,verbs=get;list;watch;create;update;patch;delete diff --git a/applicationset/controllers/applicationset_controller_test.go b/applicationset/controllers/applicationset_controller_test.go index 45a60237efcb8..dd934cc7dd53f 100644 --- a/applicationset/controllers/applicationset_controller_test.go +++ b/applicationset/controllers/applicationset_controller_test.go @@ -26,11 +26,12 @@ import ( "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" "sigs.k8s.io/controller-runtime/pkg/event" - "github.com/argoproj/argo-cd/v2/applicationset/generators" - "github.com/argoproj/argo-cd/v2/applicationset/utils" "github.com/argoproj/gitops-engine/pkg/health" "github.com/argoproj/gitops-engine/pkg/sync/common" + "github.com/argoproj/argo-cd/v2/applicationset/generators" + "github.com/argoproj/argo-cd/v2/applicationset/utils" + "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" appclientset "github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned/fake" "github.com/argoproj/argo-cd/v2/util/collections" diff --git a/applicationset/controllers/requeue_after_test.go b/applicationset/controllers/requeue_after_test.go index 7a95c4d60b738..a831b70ed2275 100644 --- a/applicationset/controllers/requeue_after_test.go +++ b/applicationset/controllers/requeue_after_test.go @@ -5,9 +5,6 @@ import ( "testing" "time" - "github.com/argoproj/argo-cd/v2/applicationset/generators" - "github.com/argoproj/argo-cd/v2/applicationset/services/mocks" - argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" "github.com/stretchr/testify/assert" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" @@ -17,6 +14,10 @@ import ( kubefake "k8s.io/client-go/kubernetes/fake" "k8s.io/client-go/tools/record" "sigs.k8s.io/controller-runtime/pkg/client/fake" + + "github.com/argoproj/argo-cd/v2/applicationset/generators" + "github.com/argoproj/argo-cd/v2/applicationset/services/mocks" + argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" ) func TestRequeueAfter(t *testing.T) { @@ -59,9 +60,9 @@ func TestRequeueAfter(t *testing.T) { "List": generators.NewListGenerator(), "Clusters": generators.NewClusterGenerator(k8sClient, ctx, appClientset, "argocd"), "Git": generators.NewGitGenerator(mockServer), - "SCMProvider": generators.NewSCMProviderGenerator(fake.NewClientBuilder().WithObjects(&corev1.Secret{}).Build(), generators.SCMAuthProviders{}), + "SCMProvider": generators.NewSCMProviderGenerator(fake.NewClientBuilder().WithObjects(&corev1.Secret{}).Build(), generators.SCMAuthProviders{}, ""), "ClusterDecisionResource": generators.NewDuckTypeGenerator(ctx, fakeDynClient, appClientset, "argocd"), - "PullRequest": generators.NewPullRequestGenerator(k8sClient, generators.SCMAuthProviders{}), + "PullRequest": generators.NewPullRequestGenerator(k8sClient, generators.SCMAuthProviders{}, ""), } nestedGenerators := map[string]generators.Generator{ diff --git a/applicationset/generators/cluster.go b/applicationset/generators/cluster.go index 9486d0e5e4475..587b0dfa5955f 100644 --- a/applicationset/generators/cluster.go +++ b/applicationset/generators/cluster.go @@ -61,8 +61,7 @@ func (g *ClusterGenerator) GetTemplate(appSetGenerator *argoappsetv1alpha1.Appli return &appSetGenerator.Clusters.Template } -func (g *ClusterGenerator) GenerateParams( - appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator, appSet *argoappsetv1alpha1.ApplicationSet) ([]map[string]interface{}, error) { +func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator, appSet *argoappsetv1alpha1.ApplicationSet) ([]map[string]interface{}, error) { if appSetGenerator == nil { return nil, EmptyAppSetGeneratorError diff --git a/applicationset/generators/duck_type_test.go b/applicationset/generators/duck_type_test.go index 21882e86575ed..788457b27559c 100644 --- a/applicationset/generators/duck_type_test.go +++ b/applicationset/generators/duck_type_test.go @@ -3,6 +3,7 @@ package generators import ( "context" "fmt" + "testing" "github.com/stretchr/testify/assert" corev1 "k8s.io/api/core/v1" @@ -15,8 +16,6 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" - - "testing" ) const resourceApiVersion = "mallard.io/v1" diff --git a/applicationset/generators/generator_spec_processor.go b/applicationset/generators/generator_spec_processor.go index e9b6f5ef278ea..a6af3ae8c45cd 100644 --- a/applicationset/generators/generator_spec_processor.go +++ b/applicationset/generators/generator_spec_processor.go @@ -4,9 +4,10 @@ import ( "fmt" "reflect" - "github.com/argoproj/argo-cd/v2/applicationset/utils" "github.com/jeremywohl/flatten" + "github.com/argoproj/argo-cd/v2/applicationset/utils" + "k8s.io/apimachinery/pkg/labels" argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" diff --git a/applicationset/generators/generator_spec_processor_test.go b/applicationset/generators/generator_spec_processor_test.go index b9756ee7fc6d4..6ca1061a1c9de 100644 --- a/applicationset/generators/generator_spec_processor_test.go +++ b/applicationset/generators/generator_spec_processor_test.go @@ -4,13 +4,14 @@ import ( "context" "testing" - "github.com/argoproj/argo-cd/v2/applicationset/services/mocks" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "github.com/argoproj/argo-cd/v2/applicationset/services/mocks" + argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" "github.com/stretchr/testify/mock" diff --git a/applicationset/generators/list.go b/applicationset/generators/list.go index 62b65650352a4..b3afabe6dac7d 100644 --- a/applicationset/generators/list.go +++ b/applicationset/generators/list.go @@ -5,8 +5,9 @@ import ( "fmt" "time" - argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" "sigs.k8s.io/yaml" + + argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" ) var _ Generator = (*ListGenerator)(nil) diff --git a/applicationset/generators/pull_request.go b/applicationset/generators/pull_request.go index edfe35b42bc4f..d861010daa65e 100644 --- a/applicationset/generators/pull_request.go +++ b/applicationset/generators/pull_request.go @@ -25,12 +25,14 @@ type PullRequestGenerator struct { client client.Client selectServiceProviderFunc func(context.Context, *argoprojiov1alpha1.PullRequestGenerator, *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error) auth SCMAuthProviders + scmRootCAPath string } -func NewPullRequestGenerator(client client.Client, auth SCMAuthProviders) Generator { +func NewPullRequestGenerator(client client.Client, auth SCMAuthProviders, scmRootCAPath string) Generator { g := &PullRequestGenerator{ - client: client, - auth: auth, + client: client, + auth: auth, + scmRootCAPath: scmRootCAPath, } g.selectServiceProviderFunc = g.selectServiceProvider return g @@ -126,7 +128,7 @@ func (g *PullRequestGenerator) selectServiceProvider(ctx context.Context, genera if err != nil { return nil, fmt.Errorf("error fetching Secret token: %v", err) } - return pullrequest.NewGitLabService(ctx, token, providerConfig.API, providerConfig.Project, providerConfig.Labels, providerConfig.PullRequestState) + return pullrequest.NewGitLabService(ctx, token, providerConfig.API, providerConfig.Project, providerConfig.Labels, providerConfig.PullRequestState, g.scmRootCAPath, providerConfig.Insecure) } if generatorConfig.Gitea != nil { providerConfig := generatorConfig.Gitea diff --git a/applicationset/generators/scm_provider.go b/applicationset/generators/scm_provider.go index 9d0b386c30e4f..34742f4822ef8 100644 --- a/applicationset/generators/scm_provider.go +++ b/applicationset/generators/scm_provider.go @@ -26,16 +26,18 @@ type SCMProviderGenerator struct { // Testing hooks. overrideProvider scm_provider.SCMProviderService SCMAuthProviders + scmRootCAPath string } type SCMAuthProviders struct { GitHubApps github_app_auth.Credentials } -func NewSCMProviderGenerator(client client.Client, providers SCMAuthProviders) Generator { +func NewSCMProviderGenerator(client client.Client, providers SCMAuthProviders, scmRootCAPath string) Generator { return &SCMProviderGenerator{ client: client, SCMAuthProviders: providers, + scmRootCAPath: scmRootCAPath, } } @@ -85,7 +87,7 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha if err != nil { return nil, fmt.Errorf("error fetching Gitlab token: %v", err) } - provider, err = scm_provider.NewGitlabProvider(ctx, providerConfig.Gitlab.Group, token, providerConfig.Gitlab.API, providerConfig.Gitlab.AllBranches, providerConfig.Gitlab.IncludeSubgroups) + provider, err = scm_provider.NewGitlabProvider(ctx, providerConfig.Gitlab.Group, token, providerConfig.Gitlab.API, providerConfig.Gitlab.AllBranches, providerConfig.Gitlab.IncludeSubgroups, providerConfig.Gitlab.Insecure, g.scmRootCAPath) if err != nil { return nil, fmt.Errorf("error initializing Gitlab service: %v", err) } diff --git a/applicationset/services/pull_request/gitlab.go b/applicationset/services/pull_request/gitlab.go index 33bbdcd954fb0..9732991c76fcf 100644 --- a/applicationset/services/pull_request/gitlab.go +++ b/applicationset/services/pull_request/gitlab.go @@ -3,8 +3,11 @@ package pull_request import ( "context" "fmt" + "net/http" "os" + "github.com/argoproj/argo-cd/v2/applicationset/utils" + "github.com/hashicorp/go-retryablehttp" gitlab "github.com/xanzy/go-gitlab" ) @@ -17,7 +20,7 @@ type GitLabService struct { var _ PullRequestService = (*GitLabService)(nil) -func NewGitLabService(ctx context.Context, token, url, project string, labels []string, pullRequestState string) (PullRequestService, error) { +func NewGitLabService(ctx context.Context, token, url, project string, labels []string, pullRequestState string, scmRootCAPath string, insecure bool) (PullRequestService, error) { var clientOptionFns []gitlab.ClientOptionFunc // Set a custom Gitlab base URL if one is provided @@ -29,6 +32,14 @@ func NewGitLabService(ctx context.Context, token, url, project string, labels [] token = os.Getenv("GITLAB_TOKEN") } + tr := &http.Transport{ + TLSClientConfig: utils.GetTlsConfig(scmRootCAPath, insecure), + } + retryClient := retryablehttp.NewClient() + retryClient.HTTPClient.Transport = tr + + clientOptionFns = append(clientOptionFns, gitlab.WithHTTPClient(retryClient.HTTPClient)) + client, err := gitlab.NewClient(token, clientOptionFns...) if err != nil { return nil, fmt.Errorf("error creating Gitlab client: %v", err) diff --git a/applicationset/services/pull_request/gitlab_test.go b/applicationset/services/pull_request/gitlab_test.go index 3aba534aec42a..59c476fcd713a 100644 --- a/applicationset/services/pull_request/gitlab_test.go +++ b/applicationset/services/pull_request/gitlab_test.go @@ -34,7 +34,7 @@ func TestGitLabServiceCustomBaseURL(t *testing.T) { writeMRListResponse(t, w) }) - svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", nil, "") + svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", nil, "", "", false) assert.NoError(t, err) _, err = svc.List(context.Background()) @@ -53,7 +53,7 @@ func TestGitLabServiceToken(t *testing.T) { writeMRListResponse(t, w) }) - svc, err := NewGitLabService(context.Background(), "token-123", server.URL, "278964", nil, "") + svc, err := NewGitLabService(context.Background(), "token-123", server.URL, "278964", nil, "", "", false) assert.NoError(t, err) _, err = svc.List(context.Background()) @@ -72,7 +72,7 @@ func TestList(t *testing.T) { writeMRListResponse(t, w) }) - svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{}, "") + svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{}, "", "", false) assert.NoError(t, err) prs, err := svc.List(context.Background()) @@ -96,7 +96,7 @@ func TestListWithLabels(t *testing.T) { writeMRListResponse(t, w) }) - svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{"feature", "ready"}, "") + svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{"feature", "ready"}, "", "", false) assert.NoError(t, err) _, err = svc.List(context.Background()) @@ -115,7 +115,7 @@ func TestListWithState(t *testing.T) { writeMRListResponse(t, w) }) - svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{}, "opened") + svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{}, "opened", "", false) assert.NoError(t, err) _, err = svc.List(context.Background()) diff --git a/applicationset/services/scm_provider/gitlab.go b/applicationset/services/scm_provider/gitlab.go index b08b21895bda9..ac3d5668d327c 100644 --- a/applicationset/services/scm_provider/gitlab.go +++ b/applicationset/services/scm_provider/gitlab.go @@ -7,6 +7,8 @@ import ( "os" pathpkg "path" + "github.com/argoproj/argo-cd/v2/applicationset/utils" + "github.com/hashicorp/go-retryablehttp" "github.com/xanzy/go-gitlab" ) @@ -19,21 +21,28 @@ type GitlabProvider struct { var _ SCMProviderService = &GitlabProvider{} -func NewGitlabProvider(ctx context.Context, organization string, token string, url string, allBranches, includeSubgroups bool) (*GitlabProvider, error) { +func NewGitlabProvider(ctx context.Context, organization string, token string, url string, allBranches, includeSubgroups, insecure bool, scmRootCAPath string) (*GitlabProvider, error) { // Undocumented environment variable to set a default token, to be used in testing to dodge anonymous rate limits. if token == "" { token = os.Getenv("GITLAB_TOKEN") } var client *gitlab.Client + + tr := &http.Transport{ + TLSClientConfig: utils.GetTlsConfig(scmRootCAPath, insecure), + } + retryClient := retryablehttp.NewClient() + retryClient.HTTPClient.Transport = tr + if url == "" { var err error - client, err = gitlab.NewClient(token) + client, err = gitlab.NewClient(token, gitlab.WithHTTPClient(retryClient.HTTPClient)) if err != nil { return nil, err } } else { var err error - client, err = gitlab.NewClient(token, gitlab.WithBaseURL(url)) + client, err = gitlab.NewClient(token, gitlab.WithBaseURL(url), gitlab.WithHTTPClient(retryClient.HTTPClient)) if err != nil { return nil, err } diff --git a/applicationset/services/scm_provider/gitlab_test.go b/applicationset/services/scm_provider/gitlab_test.go index 2fd61f28b6eea..6611669ba4941 100644 --- a/applicationset/services/scm_provider/gitlab_test.go +++ b/applicationset/services/scm_provider/gitlab_test.go @@ -286,10 +286,10 @@ func gitlabMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) { } func TestGitlabListRepos(t *testing.T) { cases := []struct { - name, proto, url string - hasError, allBranches, includeSubgroups bool - branches []string - filters []v1alpha1.SCMProviderGeneratorFilter + name, proto, url string + hasError, allBranches, includeSubgroups, insecure bool + branches []string + filters []v1alpha1.SCMProviderGeneratorFilter }{ { name: "blank protocol", @@ -323,7 +323,7 @@ func TestGitlabListRepos(t *testing.T) { })) for _, c := range cases { t.Run(c.name, func(t *testing.T) { - provider, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, c.allBranches, c.includeSubgroups) + provider, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, c.allBranches, c.includeSubgroups, c.insecure, "") rawRepos, err := ListRepos(context.Background(), provider, c.filters, c.proto) if c.hasError { assert.NotNil(t, err) @@ -352,7 +352,7 @@ func TestGitlabHasPath(t *testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { gitlabMockHandler(t)(w, r) })) - host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true) + host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true, false, "") repo := &Repository{ Organization: "test-argocd-proton", Repository: "argocd", @@ -398,7 +398,7 @@ func TestGitlabGetBranches(t *testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { gitlabMockHandler(t)(w, r) })) - host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true) + host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true, false, "") repo := &Repository{ RepositoryId: 27084533, diff --git a/applicationset/utils/utils.go b/applicationset/utils/utils.go index ca0e508858375..5b5fbc69ca031 100644 --- a/applicationset/utils/utils.go +++ b/applicationset/utils/utils.go @@ -2,9 +2,12 @@ package utils import ( "bytes" + "crypto/tls" + "crypto/x509" "encoding/json" "fmt" "io" + "os" "reflect" "regexp" "sort" @@ -406,3 +409,38 @@ func SanitizeName(name string) string { return strings.Trim(name, "-.") } + +func getTlsConfigWithCACert(scmRootCAPath string) *tls.Config { + + tlsConfig := &tls.Config{} + + if scmRootCAPath != "" { + _, err := os.Stat(scmRootCAPath) + if os.IsNotExist(err) { + log.Errorf("scmRootCAPath '%s' specified does not exist: %s", scmRootCAPath, err) + return tlsConfig + } + rootCA, err := os.ReadFile(scmRootCAPath) + if err != nil { + log.Errorf("error reading certificate from file '%s', proceeding without custom rootCA : %s", scmRootCAPath, err) + return tlsConfig + } + certPool := x509.NewCertPool() + ok := certPool.AppendCertsFromPEM([]byte(rootCA)) + if !ok { + log.Errorf("failed to append certificates from PEM: proceeding without custom rootCA") + } else { + tlsConfig.RootCAs = certPool + } + } + return tlsConfig +} + +func GetTlsConfig(scmRootCAPath string, insecure bool) *tls.Config { + tlsConfig := getTlsConfigWithCACert(scmRootCAPath) + + if insecure { + tlsConfig.InsecureSkipVerify = true + } + return tlsConfig +} diff --git a/applicationset/utils/utils_test.go b/applicationset/utils/utils_test.go index 8e7bfa58d4fa8..b1f7c1164f104 100644 --- a/applicationset/utils/utils_test.go +++ b/applicationset/utils/utils_test.go @@ -1,6 +1,9 @@ package utils import ( + "crypto/x509" + "os" + "path" "testing" "time" @@ -1065,3 +1068,92 @@ func TestNormalizeBitbucketBasePath(t *testing.T) { assert.Equal(t, c.expectedBasePath, result, c.testName) } } + +func TestGetTLSConfig(t *testing.T) { + // certParsed, err := tls.X509KeyPair(test.Cert, test.PrivateKey) + // require.NoError(t, err) + + temppath := t.TempDir() + cert := ` +-----BEGIN CERTIFICATE----- +MIIFvTCCA6WgAwIBAgIUGrTmW3qc39zqnE08e3qNDhUkeWswDQYJKoZIhvcNAQEL +BQAwbjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAklMMRAwDgYDVQQHDAdDaGljYWdv +MRQwEgYDVQQKDAtDYXBvbmUsIEluYzEQMA4GA1UECwwHU3BlY09wczEYMBYGA1UE +AwwPZm9vLmV4YW1wbGUuY29tMB4XDTE5MDcwODEzNTUwNVoXDTIwMDcwNzEzNTUw +NVowbjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAklMMRAwDgYDVQQHDAdDaGljYWdv +MRQwEgYDVQQKDAtDYXBvbmUsIEluYzEQMA4GA1UECwwHU3BlY09wczEYMBYGA1UE +AwwPZm9vLmV4YW1wbGUuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC +AgEA3csSO13w7qQXKeSLNcpeuAe6wAjXYbRkRl6ariqzTEDcFTKmy2QiXJTKoEGn +bvwxq0T91var7rxY88SGL/qi8Zmo0tVSR0XvKSKcghFIkQOTyDmVgMPZGCvixt4q +gQ7hUVSk4KkFmtcqBVuvnzI1d/DKfZAGKdmGcfRpuAsnVhac3swP0w4Tl1BFrK9U +vuIkz4KwXG77s5oB8rMUnyuLasLsGNpvpvXhkcQRhp6vpcCO2bS7kOTTelAPIucw +P37qkOEdZdiWCLrr57dmhg6tmcVlmBMg6JtmfLxn2HQd9ZrCKlkWxMk5NYs6CAW5 +kgbDZUWQTAsnHeoJKbcgtPkIbxDRxNpPukFMtbA4VEWv1EkODXy9FyEKDOI/PV6K +/80oLkgCIhCkP2mvwSFheU0RHTuZ0o0vVolP5TEOq5iufnDN4wrxqb12o//XLRc0 +RiLqGVVxhFdyKCjVxcLfII9AAp5Tse4PMh6bf6jDfB3OMvGkhMbJWhKXdR2NUTl0 +esKawMPRXIn5g3oBdNm8kyRsTTnvB567pU8uNSmA8j3jxfGCPynI8JdiwKQuW/+P +WgLIflgxqAfG85dVVOsFmF9o5o24dDslvv9yHnHH102c6ijPCg1EobqlyFzqqxOD +Wf2OPjIkzoTH+O27VRugnY/maIU1nshNO7ViRX5zIxEUtNMCAwEAAaNTMFEwHQYD +VR0OBBYEFNY4gDLgPBidogkmpO8nq5yAq5g+MB8GA1UdIwQYMBaAFNY4gDLgPBid +ogkmpO8nq5yAq5g+MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIB +AJ0WGioNtGNg3m6ywpmxNThorQD5ZvDMlmZlDVk78E2wfNyMhwbVhKhlAnONv0wv +kmsGjibY75nRZ+EK9PxSJ644841fryQXQ+bli5fhr7DW3uTKwaRsnzETJXRJuljq +6+c6Zyg1/mqwnyx7YvPgVh3w496DYx/jm6Fm1IEq3BzOmn6H/gGPq3gbURzEqI3h +P+kC2vJa8RZWrpa05Xk/Q1QUkErDX9vJghb9z3+GgirISZQzqWRghII/znv3NOE6 +zoIgaaWNFn8KPeBVpUoboH+IhpgibsnbTbI0G7AMtFq6qm3kn/4DZ2N2tuh1G2tT +zR2Fh7hJbU7CrqxANrgnIoHG/nLSvzE24ckLb0Vj69uGQlwnZkn9fz6F7KytU+Az +NoB2rjufaB0GQi1azdboMvdGSOxhSCAR8otWT5yDrywCqVnEvjw0oxKmuRduNe2/ +6AcG6TtK2/K+LHuhymiAwZM2qE6VD2odvb+tCzDkZOIeoIz/JcVlNpXE9FuVl250 +9NWvugeghq7tUv81iJ8ninBefJ4lUfxAehTPQqX+zXcfxgjvMRCi/ig73nLyhmjx +r2AaraPFgrprnxUibP4L7jxdr+iiw5bWN9/B81PodrS7n5TNtnfnpZD6X6rThqOP +xO7Tr5lAo74vNUkF2EHNaI28/RGnJPm2TIxZqy4rNH6L +-----END CERTIFICATE----- +` + + rootCAPath := path.Join(temppath, "foo.example.com") + err := os.WriteFile(rootCAPath, []byte(cert), 0666) + if err != nil { + panic(err) + } + + certPool := x509.NewCertPool() + ok := certPool.AppendCertsFromPEM([]byte(cert)) + assert.True(t, ok) + + testCases := []struct { + name string + scmRootCAPath string + insecure bool + validateCertInTlsConfig bool + }{ + { + name: "Insecure mode configured, SCM Root CA Path not set", + scmRootCAPath: "", + insecure: true, + validateCertInTlsConfig: false, + }, + { + name: "SCM Root CA Path set, Insecure mode set to false", + scmRootCAPath: rootCAPath, + insecure: false, + validateCertInTlsConfig: true, + }, + { + name: "SCM Root CA Path set, Insecure mode set to true", + scmRootCAPath: rootCAPath, + insecure: true, + validateCertInTlsConfig: true, + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + tlsConfig := GetTlsConfig(testCase.scmRootCAPath, testCase.insecure) + assert.Equal(t, testCase.insecure, tlsConfig.InsecureSkipVerify) + if testCase.validateCertInTlsConfig { + assert.NotNil(t, tlsConfig) + assert.True(t, tlsConfig.RootCAs.Equal(certPool)) + } + }) + } +} diff --git a/applicationset/webhook/webhook_test.go b/applicationset/webhook/webhook_test.go index eb36cc1730193..2d683762d7170 100644 --- a/applicationset/webhook/webhook_test.go +++ b/applicationset/webhook/webhook_test.go @@ -20,12 +20,13 @@ import ( kubefake "k8s.io/client-go/kubernetes/fake" "sigs.k8s.io/controller-runtime/pkg/client/fake" + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" + "github.com/argoproj/argo-cd/v2/applicationset/generators" "github.com/argoproj/argo-cd/v2/applicationset/services/scm_provider" "github.com/argoproj/argo-cd/v2/common" "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" argosettings "github.com/argoproj/argo-cd/v2/util/settings" - apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" ) type generatorMock struct { diff --git a/assets/swagger.json b/assets/swagger.json index 347f7cb53397a..f8a7b3208793d 100644 --- a/assets/swagger.json +++ b/assets/swagger.json @@ -7595,6 +7595,10 @@ "description": "The GitLab API URL to talk to. If blank, uses https://gitlab.com/.", "type": "string" }, + "insecure": { + "type": "boolean", + "title": "Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false" + }, "labels": { "type": "array", "title": "Labels is used to filter the MRs that you want to target", @@ -8565,6 +8569,10 @@ "type": "boolean", "title": "Recurse through subgroups (true) or scan only the base group (false). Defaults to \"false\"" }, + "insecure": { + "type": "boolean", + "title": "Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false" + }, "tokenRef": { "$ref": "#/definitions/v1alpha1SecretRef" } diff --git a/cmd/argocd-applicationset-controller/commands/applicationset_controller.go b/cmd/argocd-applicationset-controller/commands/applicationset_controller.go index 368328ecd8ca7..f873c912d4f73 100644 --- a/cmd/argocd-applicationset-controller/commands/applicationset_controller.go +++ b/cmd/argocd-applicationset-controller/commands/applicationset_controller.go @@ -64,6 +64,7 @@ func NewCommand() *cobra.Command { repoServerStrictTLS bool repoServerTimeoutSeconds int maxConcurrentReconciliations int + scmRootCAPath string ) scheme := runtime.NewScheme() _ = clientgoscheme.AddToScheme(scheme) @@ -158,9 +159,9 @@ func NewCommand() *cobra.Command { "List": generators.NewListGenerator(), "Clusters": generators.NewClusterGenerator(mgr.GetClient(), ctx, k8sClient, namespace), "Git": generators.NewGitGenerator(argoCDService), - "SCMProvider": generators.NewSCMProviderGenerator(mgr.GetClient(), scmAuth), + "SCMProvider": generators.NewSCMProviderGenerator(mgr.GetClient(), scmAuth, scmRootCAPath), "ClusterDecisionResource": generators.NewDuckTypeGenerator(ctx, dynamicClient, k8sClient, namespace), - "PullRequest": generators.NewPullRequestGenerator(mgr.GetClient(), scmAuth), + "PullRequest": generators.NewPullRequestGenerator(mgr.GetClient(), scmAuth, scmRootCAPath), "Plugin": generators.NewPluginGenerator(mgr.GetClient(), ctx, k8sClient, namespace), } @@ -211,6 +212,7 @@ func NewCommand() *cobra.Command { ArgoCDNamespace: namespace, ApplicationSetNamespaces: applicationSetNamespaces, EnableProgressiveSyncs: enableProgressiveSyncs, + SCMRootCAPath: scmRootCAPath, }).SetupWithManager(mgr, enableProgressiveSyncs, maxConcurrentReconciliations); err != nil { log.Error(err, "unable to create controller", "controller", "ApplicationSet") os.Exit(1) @@ -246,6 +248,7 @@ func NewCommand() *cobra.Command { command.Flags().BoolVar(&repoServerStrictTLS, "repo-server-strict-tls", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_STRICT_TLS", false), "Whether to use strict validation of the TLS cert presented by the repo server") command.Flags().IntVar(&repoServerTimeoutSeconds, "repo-server-timeout-seconds", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS", 60, 0, math.MaxInt64), "Repo server RPC call timeout seconds.") command.Flags().IntVar(&maxConcurrentReconciliations, "concurrent-reconciliations", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_CONCURRENT_RECONCILIATIONS", 10, 1, 100), "Max concurrent reconciliations limit for the controller") + command.Flags().StringVar(&scmRootCAPath, "scm-root-ca-path", env.StringFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH", ""), "Provide Root CA Path for self-signed TLS Certificates") return &command } diff --git a/docs/operator-manual/applicationset/Add-self-signed-TLS-Certs.md b/docs/operator-manual/applicationset/Add-self-signed-TLS-Certs.md new file mode 100644 index 0000000000000..4a4ed1b44426e --- /dev/null +++ b/docs/operator-manual/applicationset/Add-self-signed-TLS-Certs.md @@ -0,0 +1,9 @@ +# Add support for self-signed TLS / Certificates for Gitlab SCM/PR Provider + +## Implementation details + +### Overview + +In order for a self-signed TLS certificate be used by an ApplicationSet's SCM / PR Gitlab Generator, the certificate needs to be mounted on the application-controller. The path of the mounted certificate must be explicitly set using the environment variable `ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH` or alternatively using parameter `--scm-root-ca-path`. The applicationset controller will read the mounted certificate to create the Gitlab client for SCM/PR Providers + +This can be achieved conveniently by setting `applicationsetcontroller.scm.root.ca.path` in the argocd-cmd-params-cm ConfigMap. Be sure to restart the ApplicationSet controller after setting this value. diff --git a/docs/operator-manual/applicationset/Generators-Pull-Request.md b/docs/operator-manual/applicationset/Generators-Pull-Request.md index bf5d1b07da794..cd37844548d29 100644 --- a/docs/operator-manual/applicationset/Generators-Pull-Request.md +++ b/docs/operator-manual/applicationset/Generators-Pull-Request.md @@ -91,6 +91,8 @@ spec: - preview # MR state is used to filter MRs only with a certain state. (optional) pullRequestState: opened + # If true, skips validating the SCM provider's TLS certificate - useful for self-signed certificates. + insecure: false requeueAfterSeconds: 1800 template: # ... @@ -101,6 +103,9 @@ spec: * `tokenRef`: A `Secret` name and key containing the GitLab access token to use for requests. If not specified, will make anonymous requests which have a lower rate limit and can only see public repositories. (Optional) * `labels`: Labels is used to filter the MRs that you want to target. (Optional) * `pullRequestState`: PullRequestState is an additional MRs filter to get only those with a certain state. Default: "" (all states) +* `insecure`: By default (false) - Skip checking the validity of the SCM's certificate - useful for self-signed TLS certificates. + +As a preferable alternative to setting `insecure` to true, you can configure self-signed TLS certificates for Gitlab by [mounting self-signed certificate to the applicationset controller](./Add-self-signed-TLS-Certs.md). ## Gitea diff --git a/docs/operator-manual/applicationset/Generators-SCM-Provider.md b/docs/operator-manual/applicationset/Generators-SCM-Provider.md index 376401db9fd53..095d6616ee5e3 100644 --- a/docs/operator-manual/applicationset/Generators-SCM-Provider.md +++ b/docs/operator-manual/applicationset/Generators-SCM-Provider.md @@ -91,6 +91,8 @@ spec: tokenRef: secretName: gitlab-token key: token + # If true, skips validating the SCM provider's TLS certificate - useful for self-signed certificates. + insecure: false template: # ... ``` @@ -100,6 +102,9 @@ spec: * `allBranches`: By default (false) the template will only be evaluated for the default branch of each repo. If this is true, every branch of every repository will be passed to the filters. If using this flag, you likely want to use a `branchMatch` filter. * `includeSubgroups`: By default (false) the controller will only search for repos directly in the base group. If this is true, it will recurse through all the subgroups searching for repos to scan. * `tokenRef`: A `Secret` name and key containing the GitLab access token to use for requests. If not specified, will make anonymous requests which have a lower rate limit and can only see public repositories. +* `insecure`: By default (false) - Skip checking the validity of the SCM's certificate - useful for self-signed TLS certificates. + +As a preferable alternative to setting `insecure` to true, you can configure self-signed TLS certificates for Gitlab by [mounting self-signed certificate to the applicationset controller](./Add-self-signed-TLS-Certs.md). For label filtering, the repository tags are used. diff --git a/docs/operator-manual/argocd-cmd-params-cm.yaml b/docs/operator-manual/argocd-cmd-params-cm.yaml index 6f0cbd518a63a..7dae71629995a 100644 --- a/docs/operator-manual/argocd-cmd-params-cm.yaml +++ b/docs/operator-manual/argocd-cmd-params-cm.yaml @@ -177,6 +177,8 @@ data: applicationsetcontroller.enable.progressive.syncs: "false" # A list of glob patterns specifying where to look for ApplicationSet resources. (default is only the ns where the controller is installed) applicationsetcontroller.namespaces: "argocd,argocd-appsets-*" + # Path of the self-signed TLS certificate for SCM/PR Gitlab Generator + applicationsetcontroller.scm.root.ca.path: "" ## Argo CD Notifications Controller Properties # Set the logging level. One of: debug|info|warn|error (default "info") diff --git a/manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml b/manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml index 429d6d8c1e923..e6dde8de5cbf4 100644 --- a/manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml +++ b/manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml @@ -127,6 +127,12 @@ spec: key: applicationsetcontroller.namespaces name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true volumeMounts: - mountPath: /app/config/ssh name: ssh-known-hosts diff --git a/manifests/core-install.yaml b/manifests/core-install.yaml index 5e32c2bc17aac..b0bc7f13f3764 100644 --- a/manifests/core-install.yaml +++ b/manifests/core-install.yaml @@ -9350,6 +9350,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -10040,6 +10042,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -13825,6 +13829,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -14515,6 +14521,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -16229,6 +16237,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -16919,6 +16929,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -18856,6 +18868,12 @@ spec: key: applicationsetcontroller.namespaces name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true image: quay.io/argoproj/argocd:latest imagePullPolicy: Always name: argocd-applicationset-controller diff --git a/manifests/crds/applicationset-crd.yaml b/manifests/crds/applicationset-crd.yaml index 5a08f884d5734..72d23d94a46b8 100644 --- a/manifests/crds/applicationset-crd.yaml +++ b/manifests/crds/applicationset-crd.yaml @@ -4863,6 +4863,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -5553,6 +5555,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -9338,6 +9342,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -10028,6 +10034,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -11742,6 +11750,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -12432,6 +12442,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: diff --git a/manifests/ha/install.yaml b/manifests/ha/install.yaml index 6250ef1f4a7af..68b53246c0d32 100644 --- a/manifests/ha/install.yaml +++ b/manifests/ha/install.yaml @@ -9350,6 +9350,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -10040,6 +10042,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -13825,6 +13829,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -14515,6 +14521,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -16229,6 +16237,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -16919,6 +16929,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -20093,6 +20105,12 @@ spec: key: applicationsetcontroller.namespaces name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true image: quay.io/argoproj/argocd:latest imagePullPolicy: Always name: argocd-applicationset-controller diff --git a/manifests/ha/namespace-install.yaml b/manifests/ha/namespace-install.yaml index 2b75d549ff79d..6b9adc7d08071 100644 --- a/manifests/ha/namespace-install.yaml +++ b/manifests/ha/namespace-install.yaml @@ -1623,6 +1623,12 @@ spec: key: applicationsetcontroller.namespaces name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true image: quay.io/argoproj/argocd:latest imagePullPolicy: Always name: argocd-applicationset-controller diff --git a/manifests/install.yaml b/manifests/install.yaml index e08143a7b92da..d9c3fc9d4eb14 100644 --- a/manifests/install.yaml +++ b/manifests/install.yaml @@ -9350,6 +9350,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -10040,6 +10042,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -13825,6 +13829,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -14515,6 +14521,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -16229,6 +16237,8 @@ spec: properties: api: type: string + insecure: + type: boolean labels: items: type: string @@ -16919,6 +16929,8 @@ spec: type: string includeSubgroups: type: boolean + insecure: + type: boolean tokenRef: properties: key: @@ -19194,6 +19206,12 @@ spec: key: applicationsetcontroller.namespaces name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true image: quay.io/argoproj/argocd:latest imagePullPolicy: Always name: argocd-applicationset-controller diff --git a/manifests/namespace-install.yaml b/manifests/namespace-install.yaml index 785ce544b2503..9041dc52b3814 100644 --- a/manifests/namespace-install.yaml +++ b/manifests/namespace-install.yaml @@ -724,6 +724,12 @@ spec: key: applicationsetcontroller.namespaces name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true image: quay.io/argoproj/argocd:latest imagePullPolicy: Always name: argocd-applicationset-controller diff --git a/pkg/apis/application/v1alpha1/applicationset_types.go b/pkg/apis/application/v1alpha1/applicationset_types.go index 3c8b3a34a018b..19edd05646209 100644 --- a/pkg/apis/application/v1alpha1/applicationset_types.go +++ b/pkg/apis/application/v1alpha1/applicationset_types.go @@ -439,6 +439,8 @@ type SCMProviderGeneratorGitlab struct { TokenRef *SecretRef `json:"tokenRef,omitempty" protobuf:"bytes,4,opt,name=tokenRef"` // Scan all branches instead of just the default branch. AllBranches bool `json:"allBranches,omitempty" protobuf:"varint,5,opt,name=allBranches"` + // Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false + Insecure bool `json:"insecure,omitempty" protobuf:"varint,6,opt,name=insecure"` } // SCMProviderGeneratorBitbucket defines connection info specific to Bitbucket Cloud (API version 2). @@ -589,6 +591,8 @@ type PullRequestGeneratorGitLab struct { Labels []string `json:"labels,omitempty" protobuf:"bytes,4,rep,name=labels"` // PullRequestState is an additional MRs filter to get only those with a certain state. Default: "" (all states) PullRequestState string `json:"pullRequestState,omitempty" protobuf:"bytes,5,rep,name=pullRequestState"` + // Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false + Insecure bool `json:"insecure,omitempty" protobuf:"varint,6,opt,name=insecure"` } // PullRequestGeneratorBitbucketServer defines connection info specific to BitbucketServer. diff --git a/pkg/apis/application/v1alpha1/generated.pb.go b/pkg/apis/application/v1alpha1/generated.pb.go index 824765ad461a7..9e9ffa0023d55 100644 --- a/pkg/apis/application/v1alpha1/generated.pb.go +++ b/pkg/apis/application/v1alpha1/generated.pb.go @@ -4300,668 +4300,668 @@ func init() { } var fileDescriptor_030104ce3b95bcac = []byte{ - // 10565 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7d, 0x6d, 0x70, 0x24, 0xc7, - 0x75, 0x98, 0x66, 0x3f, 0x80, 0xdd, 0x07, 0xdc, 0x07, 0xfa, 0xee, 0x48, 0xf0, 0x44, 0x12, 0xe7, - 0x61, 0x99, 0xa2, 0x22, 0x12, 0x30, 0x4f, 0xa4, 0xc2, 0x98, 0xb6, 0x64, 0x2c, 0x70, 0x87, 0xc3, - 0x1d, 0x70, 0x00, 0x1b, 0xb8, 0x3b, 0x89, 0x32, 0x45, 0x0d, 0x66, 0x1b, 0x8b, 0x39, 0xcc, 0xce, - 0x2c, 0x67, 0x66, 0x71, 0x00, 0x2d, 0xc9, 0x92, 0xe5, 0x0f, 0x25, 0xfa, 0x8c, 0x94, 0x94, 0xe5, - 0x24, 0x72, 0x64, 0xcb, 0x49, 0xc5, 0x95, 0xb0, 0xe2, 0x24, 0x3f, 0xe2, 0xc4, 0x49, 0xb9, 0x6c, - 0xe7, 0x87, 0x52, 0x4a, 0x2a, 0xaa, 0x94, 0xcb, 0x72, 0x62, 0x1b, 0x91, 0x90, 0x4a, 0x25, 0x95, - 0xaa, 0xb8, 0x2a, 0x1f, 0x3f, 0x92, 0x4b, 0xaa, 0x92, 0xea, 0xef, 0x9e, 0xd9, 0xd9, 0xc3, 0x02, - 0x18, 0xdc, 0x9d, 0x14, 0xfe, 0xdb, 0xed, 0xf7, 0xe6, 0xbd, 0x37, 0x3d, 0xdd, 0xaf, 0x5f, 0xbf, - 0x7e, 0xef, 0x35, 0x2c, 0xb4, 0xbc, 0x64, 0xa3, 0xbb, 0x36, 0xe9, 0x86, 0xed, 0x29, 0x27, 0x6a, - 0x85, 0x9d, 0x28, 0xbc, 0xcd, 0x7e, 0x3c, 0xe7, 0x36, 0xa7, 0xb6, 0x2e, 0x4e, 0x75, 0x36, 0x5b, - 0x53, 0x4e, 0xc7, 0x8b, 0xa7, 0x9c, 0x4e, 0xc7, 0xf7, 0x5c, 0x27, 0xf1, 0xc2, 0x60, 0x6a, 0xeb, - 0x79, 0xc7, 0xef, 0x6c, 0x38, 0xcf, 0x4f, 0xb5, 0x48, 0x40, 0x22, 0x27, 0x21, 0xcd, 0xc9, 0x4e, - 0x14, 0x26, 0x21, 0xfa, 0x31, 0x4d, 0x6d, 0x52, 0x52, 0x63, 0x3f, 0x5e, 0x77, 0x9b, 0x93, 0x5b, - 0x17, 0x27, 0x3b, 0x9b, 0xad, 0x49, 0x4a, 0x6d, 0xd2, 0xa0, 0x36, 0x29, 0xa9, 0x9d, 0x7f, 0xce, - 0x90, 0xa5, 0x15, 0xb6, 0xc2, 0x29, 0x46, 0x74, 0xad, 0xbb, 0xce, 0xfe, 0xb1, 0x3f, 0xec, 0x17, - 0x67, 0x76, 0xde, 0xde, 0x7c, 0x29, 0x9e, 0xf4, 0x42, 0x2a, 0xde, 0x94, 0x1b, 0x46, 0x64, 0x6a, - 0xab, 0x47, 0xa0, 0xf3, 0x57, 0x34, 0x0e, 0xd9, 0x4e, 0x48, 0x10, 0x7b, 0x61, 0x10, 0x3f, 0x47, - 0x45, 0x20, 0xd1, 0x16, 0x89, 0xcc, 0xd7, 0x33, 0x10, 0xf2, 0x28, 0xbd, 0xa0, 0x29, 0xb5, 0x1d, - 0x77, 0xc3, 0x0b, 0x48, 0xb4, 0xa3, 0x1f, 0x6f, 0x93, 0xc4, 0xc9, 0x7b, 0x6a, 0xaa, 0xdf, 0x53, - 0x51, 0x37, 0x48, 0xbc, 0x36, 0xe9, 0x79, 0xe0, 0x7d, 0xfb, 0x3d, 0x10, 0xbb, 0x1b, 0xa4, 0xed, - 0xf4, 0x3c, 0xf7, 0xde, 0x7e, 0xcf, 0x75, 0x13, 0xcf, 0x9f, 0xf2, 0x82, 0x24, 0x4e, 0xa2, 0xec, - 0x43, 0xf6, 0x1b, 0x70, 0x62, 0xfa, 0xd6, 0xca, 0x74, 0x37, 0xd9, 0x98, 0x09, 0x83, 0x75, 0xaf, - 0x85, 0x5e, 0x84, 0x11, 0xd7, 0xef, 0xc6, 0x09, 0x89, 0xae, 0x3b, 0x6d, 0x32, 0x6e, 0x5d, 0xb0, - 0x9e, 0xa9, 0x37, 0xce, 0x7c, 0x73, 0x77, 0xe2, 0x1d, 0x7b, 0xbb, 0x13, 0x23, 0x33, 0x1a, 0x84, - 0x4d, 0x3c, 0xf4, 0x6e, 0x18, 0x8e, 0x42, 0x9f, 0x4c, 0xe3, 0xeb, 0xe3, 0x25, 0xf6, 0xc8, 0x29, - 0xf1, 0xc8, 0x30, 0xe6, 0xcd, 0x58, 0xc2, 0xed, 0x3f, 0x28, 0x01, 0x4c, 0x77, 0x3a, 0xcb, 0x51, - 0x78, 0x9b, 0xb8, 0x09, 0xfa, 0x28, 0xd4, 0x68, 0xd7, 0x35, 0x9d, 0xc4, 0x61, 0xdc, 0x46, 0x2e, - 0xfe, 0xc8, 0x24, 0x7f, 0x93, 0x49, 0xf3, 0x4d, 0xf4, 0xc0, 0xa1, 0xd8, 0x93, 0x5b, 0xcf, 0x4f, - 0x2e, 0xad, 0xd1, 0xe7, 0x17, 0x49, 0xe2, 0x34, 0x90, 0x60, 0x06, 0xba, 0x0d, 0x2b, 0xaa, 0x28, - 0x80, 0x4a, 0xdc, 0x21, 0x2e, 0x13, 0x6c, 0xe4, 0xe2, 0xc2, 0xe4, 0x51, 0x46, 0xe8, 0xa4, 0x96, - 0x7c, 0xa5, 0x43, 0xdc, 0xc6, 0xa8, 0xe0, 0x5c, 0xa1, 0xff, 0x30, 0xe3, 0x83, 0xb6, 0x60, 0x28, - 0x4e, 0x9c, 0xa4, 0x1b, 0x8f, 0x97, 0x19, 0xc7, 0xeb, 0x85, 0x71, 0x64, 0x54, 0x1b, 0x27, 0x05, - 0xcf, 0x21, 0xfe, 0x1f, 0x0b, 0x6e, 0xf6, 0x9f, 0x58, 0x70, 0x52, 0x23, 0x2f, 0x78, 0x71, 0x82, - 0x7e, 0xb2, 0xa7, 0x73, 0x27, 0x07, 0xeb, 0x5c, 0xfa, 0x34, 0xeb, 0xda, 0xd3, 0x82, 0x59, 0x4d, - 0xb6, 0x18, 0x1d, 0xdb, 0x86, 0xaa, 0x97, 0x90, 0x76, 0x3c, 0x5e, 0xba, 0x50, 0x7e, 0x66, 0xe4, - 0xe2, 0x95, 0xa2, 0xde, 0xb3, 0x71, 0x42, 0x30, 0xad, 0xce, 0x53, 0xf2, 0x98, 0x73, 0xb1, 0x7f, - 0x7d, 0xd4, 0x7c, 0x3f, 0xda, 0xe1, 0xe8, 0x79, 0x18, 0x89, 0xc3, 0x6e, 0xe4, 0x12, 0x4c, 0x3a, - 0x61, 0x3c, 0x6e, 0x5d, 0x28, 0xd3, 0xa1, 0x47, 0x47, 0xea, 0x8a, 0x6e, 0xc6, 0x26, 0x0e, 0xfa, - 0x82, 0x05, 0xa3, 0x4d, 0x12, 0x27, 0x5e, 0xc0, 0xf8, 0x4b, 0xe1, 0x57, 0x8f, 0x2c, 0xbc, 0x6c, - 0x9c, 0xd5, 0xc4, 0x1b, 0x67, 0xc5, 0x8b, 0x8c, 0x1a, 0x8d, 0x31, 0x4e, 0xf1, 0xa7, 0x33, 0xae, - 0x49, 0x62, 0x37, 0xf2, 0x3a, 0xf4, 0x3f, 0x1b, 0x33, 0xc6, 0x8c, 0x9b, 0xd5, 0x20, 0x6c, 0xe2, - 0xa1, 0x00, 0xaa, 0x74, 0x46, 0xc5, 0xe3, 0x15, 0x26, 0xff, 0xfc, 0xd1, 0xe4, 0x17, 0x9d, 0x4a, - 0x27, 0xab, 0xee, 0x7d, 0xfa, 0x2f, 0xc6, 0x9c, 0x0d, 0xfa, 0xbc, 0x05, 0xe3, 0x62, 0xc6, 0x63, - 0xc2, 0x3b, 0xf4, 0xd6, 0x86, 0x97, 0x10, 0xdf, 0x8b, 0x93, 0xf1, 0x2a, 0x93, 0x61, 0x6a, 0xb0, - 0xb1, 0x35, 0x17, 0x85, 0xdd, 0xce, 0x35, 0x2f, 0x68, 0x36, 0x2e, 0x08, 0x4e, 0xe3, 0x33, 0x7d, - 0x08, 0xe3, 0xbe, 0x2c, 0xd1, 0x57, 0x2c, 0x38, 0x1f, 0x38, 0x6d, 0x12, 0x77, 0x1c, 0xfa, 0x69, - 0x39, 0xb8, 0xe1, 0x3b, 0xee, 0x26, 0x93, 0x68, 0xe8, 0x70, 0x12, 0xd9, 0x42, 0xa2, 0xf3, 0xd7, - 0xfb, 0x92, 0xc6, 0xf7, 0x60, 0x8b, 0xbe, 0x61, 0xc1, 0x58, 0x18, 0x75, 0x36, 0x9c, 0x80, 0x34, - 0x25, 0x34, 0x1e, 0x1f, 0x66, 0x53, 0xef, 0x23, 0x47, 0xfb, 0x44, 0x4b, 0x59, 0xb2, 0x8b, 0x61, - 0xe0, 0x25, 0x61, 0xb4, 0x42, 0x92, 0xc4, 0x0b, 0x5a, 0x71, 0xe3, 0xdc, 0xde, 0xee, 0xc4, 0x58, - 0x0f, 0x16, 0xee, 0x95, 0x07, 0xfd, 0x14, 0x8c, 0xc4, 0x3b, 0x81, 0x7b, 0xcb, 0x0b, 0x9a, 0xe1, - 0x9d, 0x78, 0xbc, 0x56, 0xc4, 0xf4, 0x5d, 0x51, 0x04, 0xc5, 0x04, 0xd4, 0x0c, 0xb0, 0xc9, 0x2d, - 0xff, 0xc3, 0xe9, 0xa1, 0x54, 0x2f, 0xfa, 0xc3, 0xe9, 0xc1, 0x74, 0x0f, 0xb6, 0xe8, 0x17, 0x2c, - 0x38, 0x11, 0x7b, 0xad, 0xc0, 0x49, 0xba, 0x11, 0xb9, 0x46, 0x76, 0xe2, 0x71, 0x60, 0x82, 0x5c, - 0x3d, 0x62, 0xaf, 0x18, 0x24, 0x1b, 0xe7, 0x84, 0x8c, 0x27, 0xcc, 0xd6, 0x18, 0xa7, 0xf9, 0xe6, - 0x4d, 0x34, 0x3d, 0xac, 0x47, 0x8a, 0x9d, 0x68, 0x7a, 0x50, 0xf7, 0x65, 0x89, 0x7e, 0x02, 0x4e, - 0xf3, 0x26, 0xd5, 0xb3, 0xf1, 0xf8, 0x28, 0x53, 0xb4, 0x67, 0xf7, 0x76, 0x27, 0x4e, 0xaf, 0x64, - 0x60, 0xb8, 0x07, 0x1b, 0xbd, 0x01, 0x13, 0x1d, 0x12, 0xb5, 0xbd, 0x64, 0x29, 0xf0, 0x77, 0xa4, - 0xfa, 0x76, 0xc3, 0x0e, 0x69, 0x0a, 0x71, 0xe2, 0xf1, 0x13, 0x17, 0xac, 0x67, 0x6a, 0x8d, 0x77, - 0x09, 0x31, 0x27, 0x96, 0xef, 0x8d, 0x8e, 0xf7, 0xa3, 0x67, 0xff, 0xf3, 0x12, 0x9c, 0xce, 0x2e, - 0x9c, 0xe8, 0x6f, 0x5a, 0x70, 0xea, 0xf6, 0x9d, 0x64, 0x35, 0xdc, 0x24, 0x41, 0xdc, 0xd8, 0xa1, - 0xea, 0x8d, 0x2d, 0x19, 0x23, 0x17, 0xdd, 0x62, 0x97, 0xe8, 0xc9, 0xab, 0x69, 0x2e, 0x97, 0x82, - 0x24, 0xda, 0x69, 0x3c, 0x2a, 0xde, 0xee, 0xd4, 0xd5, 0x5b, 0xab, 0x26, 0x14, 0x67, 0x85, 0x3a, - 0xff, 0x59, 0x0b, 0xce, 0xe6, 0x91, 0x40, 0xa7, 0xa1, 0xbc, 0x49, 0x76, 0xb8, 0x55, 0x86, 0xe9, - 0x4f, 0xf4, 0x1a, 0x54, 0xb7, 0x1c, 0xbf, 0x4b, 0x84, 0x75, 0x33, 0x77, 0xb4, 0x17, 0x51, 0x92, - 0x61, 0x4e, 0xf5, 0x47, 0x4b, 0x2f, 0x59, 0xf6, 0xbf, 0x2a, 0xc3, 0x88, 0xb1, 0xbe, 0xdd, 0x07, - 0x8b, 0x2d, 0x4c, 0x59, 0x6c, 0x8b, 0x85, 0x2d, 0xcd, 0x7d, 0x4d, 0xb6, 0x3b, 0x19, 0x93, 0x6d, - 0xa9, 0x38, 0x96, 0xf7, 0xb4, 0xd9, 0x50, 0x02, 0xf5, 0xb0, 0x43, 0x2d, 0x72, 0xba, 0xf4, 0x57, - 0x8a, 0xf8, 0x84, 0x4b, 0x92, 0x5c, 0xe3, 0xc4, 0xde, 0xee, 0x44, 0x5d, 0xfd, 0xc5, 0x9a, 0x91, - 0xfd, 0x1d, 0x0b, 0xce, 0x1a, 0x32, 0xce, 0x84, 0x41, 0xd3, 0x63, 0x9f, 0xf6, 0x02, 0x54, 0x92, - 0x9d, 0x8e, 0x34, 0xfb, 0x55, 0x4f, 0xad, 0xee, 0x74, 0x08, 0x66, 0x10, 0x6a, 0xe8, 0xb7, 0x49, - 0x1c, 0x3b, 0x2d, 0x92, 0x35, 0xf4, 0x17, 0x79, 0x33, 0x96, 0x70, 0x14, 0x01, 0xf2, 0x9d, 0x38, - 0x59, 0x8d, 0x9c, 0x20, 0x66, 0xe4, 0x57, 0xbd, 0x36, 0x11, 0x1d, 0xfc, 0x67, 0x06, 0x1b, 0x31, - 0xf4, 0x89, 0xc6, 0x23, 0x7b, 0xbb, 0x13, 0x68, 0xa1, 0x87, 0x12, 0xce, 0xa1, 0x6e, 0x7f, 0xc5, - 0x82, 0x47, 0xf2, 0x6d, 0x31, 0xf4, 0x34, 0x0c, 0xf1, 0x2d, 0x9f, 0x78, 0x3b, 0xfd, 0x49, 0x58, - 0x2b, 0x16, 0x50, 0x34, 0x05, 0x75, 0xb5, 0x4e, 0x88, 0x77, 0x1c, 0x13, 0xa8, 0x75, 0xbd, 0xb8, - 0x68, 0x1c, 0xda, 0x69, 0xf4, 0x8f, 0xb0, 0xdc, 0x54, 0xa7, 0xb1, 0x4d, 0x12, 0x83, 0xd8, 0xff, - 0xce, 0x82, 0x53, 0x86, 0x54, 0xf7, 0xc1, 0x34, 0x0f, 0xd2, 0xa6, 0xf9, 0x7c, 0x61, 0xe3, 0xb9, - 0x8f, 0x6d, 0xfe, 0x79, 0x0b, 0xce, 0x1b, 0x58, 0x8b, 0x4e, 0xe2, 0x6e, 0x5c, 0xda, 0xee, 0x44, - 0x24, 0xa6, 0xdb, 0x69, 0xf4, 0x84, 0xa1, 0xb7, 0x1a, 0x23, 0x82, 0x42, 0xf9, 0x1a, 0xd9, 0xe1, - 0x4a, 0xec, 0x59, 0xa8, 0xf1, 0xc1, 0x19, 0x46, 0xa2, 0xc7, 0xd5, 0xbb, 0x2d, 0x89, 0x76, 0xac, - 0x30, 0x90, 0x0d, 0x43, 0x4c, 0x39, 0xd1, 0xc9, 0x4a, 0x97, 0x21, 0xa0, 0x1f, 0xf1, 0x26, 0x6b, - 0xc1, 0x02, 0x62, 0x2f, 0xa5, 0xc4, 0x59, 0x8e, 0x08, 0xfb, 0xb8, 0xcd, 0xcb, 0x1e, 0xf1, 0x9b, - 0x31, 0xdd, 0x36, 0x38, 0x41, 0x10, 0x26, 0x62, 0x07, 0x60, 0x6c, 0x1b, 0xa6, 0x75, 0x33, 0x36, - 0x71, 0xec, 0xbd, 0x12, 0xdb, 0x7c, 0xa8, 0x69, 0x4d, 0xee, 0xc7, 0xce, 0x35, 0x4a, 0xe9, 0xc1, - 0xe5, 0xe2, 0x94, 0x12, 0xe9, 0xbf, 0x7b, 0x7d, 0x33, 0xa3, 0x0a, 0x71, 0xa1, 0x5c, 0xef, 0xbd, - 0x83, 0xfd, 0x9d, 0x12, 0x4c, 0xa4, 0x1f, 0xe8, 0xd1, 0xa4, 0x74, 0xbb, 0x64, 0x30, 0xca, 0x3a, - 0x28, 0x0c, 0x7c, 0x6c, 0xe2, 0xf5, 0x51, 0x46, 0xa5, 0xe3, 0x54, 0x46, 0xa6, 0xae, 0x2c, 0xef, - 0xa3, 0x2b, 0x9f, 0x56, 0xbd, 0x5e, 0xc9, 0x28, 0xa7, 0xf4, 0x7a, 0x71, 0x01, 0x2a, 0x71, 0x42, - 0x3a, 0xe3, 0xd5, 0xb4, 0xae, 0x59, 0x49, 0x48, 0x07, 0x33, 0x88, 0xfd, 0x9f, 0x4b, 0xf0, 0x68, - 0xba, 0x0f, 0xb5, 0x7a, 0xff, 0x40, 0x4a, 0xbd, 0xbf, 0xc7, 0x54, 0xef, 0x77, 0x77, 0x27, 0xde, - 0xd9, 0xe7, 0xb1, 0xef, 0x1b, 0xed, 0x8f, 0xe6, 0x32, 0xbd, 0x38, 0x95, 0xee, 0xc5, 0xbb, 0xbb, - 0x13, 0x4f, 0xf4, 0x79, 0xc7, 0x4c, 0x37, 0x3f, 0x0d, 0x43, 0x11, 0x71, 0xe2, 0x30, 0x10, 0x1d, - 0xad, 0x3e, 0x07, 0x66, 0xad, 0x58, 0x40, 0xed, 0x7f, 0x5d, 0xcf, 0x76, 0xf6, 0x1c, 0x77, 0xb0, - 0x85, 0x11, 0xf2, 0xa0, 0xc2, 0x4c, 0x76, 0xae, 0x1a, 0xae, 0x1d, 0x6d, 0x1a, 0x51, 0x15, 0xaf, - 0x48, 0x37, 0x6a, 0xf4, 0xab, 0xd1, 0x26, 0xcc, 0x58, 0xa0, 0x6d, 0xa8, 0xb9, 0xd2, 0x92, 0x2e, - 0x15, 0xe1, 0x73, 0x12, 0x76, 0xb4, 0xe6, 0x38, 0x4a, 0x75, 0xb1, 0x32, 0xbf, 0x15, 0x37, 0x44, - 0xa0, 0xdc, 0xf2, 0x12, 0xf1, 0x59, 0x8f, 0xb8, 0x57, 0x9a, 0xf3, 0x8c, 0x57, 0x1c, 0xa6, 0x0b, - 0xc4, 0x9c, 0x97, 0x60, 0x4a, 0x1f, 0xfd, 0x9c, 0x05, 0x23, 0xb1, 0xdb, 0x5e, 0x8e, 0xc2, 0x2d, - 0xaf, 0x49, 0x22, 0x61, 0x29, 0x1d, 0x51, 0x35, 0xad, 0xcc, 0x2c, 0x4a, 0x82, 0x9a, 0x2f, 0xdf, - 0xbb, 0x6a, 0x08, 0x36, 0xf9, 0xd2, 0x1d, 0xc4, 0xa3, 0xe2, 0xdd, 0x67, 0x89, 0xeb, 0xd1, 0xb5, - 0x4d, 0x6e, 0x98, 0xd8, 0x48, 0x39, 0xb2, 0xe5, 0x38, 0xdb, 0x75, 0x37, 0xe9, 0x7c, 0xd3, 0x02, - 0xbd, 0x73, 0x6f, 0x77, 0xe2, 0xd1, 0x99, 0x7c, 0x9e, 0xb8, 0x9f, 0x30, 0xac, 0xc3, 0x3a, 0x5d, - 0xdf, 0xc7, 0xe4, 0x8d, 0x2e, 0x61, 0xee, 0x90, 0x02, 0x3a, 0x6c, 0x59, 0x13, 0xcc, 0x74, 0x98, - 0x01, 0xc1, 0x26, 0x5f, 0xf4, 0x06, 0x0c, 0xb5, 0x9d, 0x24, 0xf2, 0xb6, 0x85, 0x0f, 0xe4, 0x88, - 0xb6, 0xfc, 0x22, 0xa3, 0xa5, 0x99, 0xb3, 0xa5, 0x9f, 0x37, 0x62, 0xc1, 0x08, 0xb5, 0xa1, 0xda, - 0x26, 0x51, 0x8b, 0x8c, 0xd7, 0x8a, 0xf0, 0xf7, 0x2e, 0x52, 0x52, 0x9a, 0x61, 0x9d, 0x5a, 0x3e, - 0xac, 0x0d, 0x73, 0x2e, 0xe8, 0x35, 0xa8, 0xc5, 0xc4, 0x27, 0x2e, 0xb5, 0x5d, 0xea, 0x8c, 0xe3, - 0x7b, 0x07, 0xb4, 0xe3, 0x9c, 0x35, 0xe2, 0xaf, 0x88, 0x47, 0xf9, 0x04, 0x93, 0xff, 0xb0, 0x22, - 0x49, 0x3b, 0xb0, 0xe3, 0x77, 0x5b, 0x5e, 0x30, 0x0e, 0x45, 0x74, 0xe0, 0x32, 0xa3, 0x95, 0xe9, - 0x40, 0xde, 0x88, 0x05, 0x23, 0xfb, 0x3f, 0x58, 0x80, 0xd2, 0x4a, 0xed, 0x3e, 0x18, 0xac, 0x6f, - 0xa4, 0x0d, 0xd6, 0x85, 0x22, 0xad, 0x8e, 0x3e, 0x36, 0xeb, 0x6f, 0xd5, 0x21, 0xb3, 0x1c, 0x5c, - 0x27, 0x71, 0x42, 0x9a, 0x6f, 0xab, 0xf0, 0xb7, 0x55, 0xf8, 0xdb, 0x2a, 0x5c, 0xa9, 0xf0, 0xb5, - 0x8c, 0x0a, 0x7f, 0xbf, 0x31, 0xeb, 0xf5, 0x81, 0xe9, 0xeb, 0xea, 0x44, 0xd5, 0x94, 0xc0, 0x40, - 0xa0, 0x9a, 0xe0, 0xea, 0xca, 0xd2, 0xf5, 0x5c, 0x9d, 0xfd, 0x7a, 0x5a, 0x67, 0x1f, 0x95, 0xc5, - 0xff, 0x0f, 0x5a, 0xfa, 0xaf, 0x96, 0xe0, 0xb1, 0xb4, 0xf6, 0xc2, 0xa1, 0xef, 0x87, 0xdd, 0x84, - 0xee, 0x05, 0xd0, 0x2f, 0x5b, 0x70, 0xba, 0x9d, 0xde, 0x84, 0xc7, 0xc2, 0xd7, 0xf9, 0xc1, 0xc2, - 0x54, 0x6b, 0x66, 0x97, 0xdf, 0x18, 0x17, 0x6a, 0xf6, 0x74, 0x06, 0x10, 0xe3, 0x1e, 0x59, 0xd0, - 0x6b, 0x50, 0x6f, 0x3b, 0xdb, 0x37, 0x3a, 0x4d, 0x27, 0x91, 0xdb, 0xb0, 0xfe, 0xbb, 0xe7, 0x6e, - 0xe2, 0xf9, 0x93, 0xfc, 0x04, 0x7b, 0x72, 0x3e, 0x48, 0x96, 0xa2, 0x95, 0x24, 0xf2, 0x82, 0x16, - 0xf7, 0x70, 0x2d, 0x4a, 0x32, 0x58, 0x53, 0xb4, 0xbf, 0x66, 0x65, 0x75, 0xbb, 0xea, 0x9d, 0xc8, - 0x49, 0x48, 0x6b, 0x07, 0x7d, 0x0c, 0xaa, 0x74, 0xbf, 0x24, 0x7b, 0xe5, 0x56, 0x91, 0x0b, 0x8e, - 0xf1, 0x25, 0xf4, 0xda, 0x43, 0xff, 0xc5, 0x98, 0x33, 0xb5, 0xbf, 0x32, 0x9c, 0x5d, 0x63, 0xd9, - 0x79, 0xe6, 0x45, 0x80, 0x56, 0xb8, 0x4a, 0xda, 0x1d, 0x9f, 0x76, 0x8b, 0xc5, 0x9c, 0xe2, 0xca, - 0x45, 0x30, 0xa7, 0x20, 0xd8, 0xc0, 0x42, 0x7f, 0xde, 0x02, 0x68, 0xc9, 0xa1, 0x22, 0xd7, 0xcf, - 0x1b, 0x45, 0xbe, 0x8e, 0x1e, 0x88, 0x5a, 0x16, 0xc5, 0x10, 0x1b, 0xcc, 0xd1, 0xcf, 0x58, 0x50, - 0x4b, 0xa4, 0xf8, 0x7c, 0x45, 0x59, 0x2d, 0x52, 0x12, 0xf9, 0xd2, 0xda, 0x94, 0x50, 0x5d, 0xa2, - 0xf8, 0xa2, 0x9f, 0xb7, 0x00, 0xe2, 0x9d, 0xc0, 0x5d, 0x0e, 0x7d, 0xcf, 0xdd, 0x11, 0x0b, 0xcd, - 0xcd, 0x42, 0xdd, 0x18, 0x8a, 0x7a, 0xe3, 0x24, 0xed, 0x0d, 0xfd, 0x1f, 0x1b, 0x9c, 0xd1, 0x27, - 0xa0, 0x16, 0x8b, 0xe1, 0x26, 0x96, 0x96, 0xd5, 0x62, 0x9d, 0x29, 0x9c, 0xb6, 0xd0, 0x4a, 0xe2, - 0x1f, 0x56, 0x3c, 0xd1, 0x2f, 0x5a, 0x70, 0xaa, 0x93, 0x76, 0x7d, 0x89, 0x55, 0xa4, 0x38, 0x1d, - 0x90, 0x71, 0xad, 0x35, 0xce, 0xec, 0xed, 0x4e, 0x9c, 0xca, 0x34, 0xe2, 0xac, 0x14, 0x68, 0x06, - 0xc6, 0xf4, 0x08, 0x5e, 0xea, 0x70, 0x37, 0xdc, 0x30, 0x73, 0xc3, 0xb1, 0x53, 0xcc, 0xb9, 0x2c, - 0x10, 0xf7, 0xe2, 0xa3, 0x65, 0x38, 0x4b, 0xa5, 0xdb, 0xe1, 0x56, 0x9b, 0xd4, 0xca, 0x31, 0x5b, - 0x43, 0x6a, 0x8d, 0xc7, 0xc5, 0x08, 0x61, 0x8e, 0xee, 0x2c, 0x0e, 0xce, 0x7d, 0xd2, 0xfe, 0x56, - 0x29, 0xe5, 0x17, 0x57, 0x0e, 0x2b, 0x36, 0xc7, 0x5c, 0xe9, 0x2b, 0x90, 0x2a, 0xa3, 0xd0, 0x39, - 0xa6, 0x3c, 0x11, 0x7a, 0x8e, 0xa9, 0xa6, 0x18, 0x1b, 0xcc, 0xa9, 0x01, 0x33, 0xe6, 0x64, 0xdd, - 0x62, 0x62, 0xda, 0xbf, 0x56, 0xa4, 0x48, 0xbd, 0xa7, 0x18, 0x8f, 0x09, 0xd1, 0xc6, 0x7a, 0x40, - 0xb8, 0x57, 0x24, 0xfb, 0x5b, 0x69, 0x5f, 0xbc, 0x31, 0x62, 0x07, 0x38, 0x67, 0xf8, 0x82, 0x05, - 0x23, 0x51, 0xe8, 0xfb, 0x5e, 0xd0, 0xa2, 0xb3, 0x4b, 0x2c, 0x11, 0x1f, 0x3e, 0x16, 0x2d, 0x2d, - 0xa6, 0x11, 0x33, 0x83, 0xb0, 0xe6, 0x89, 0x4d, 0x01, 0xec, 0x3f, 0xb1, 0x60, 0xbc, 0x9f, 0x16, - 0x40, 0x04, 0xde, 0x29, 0x87, 0xb8, 0x3a, 0x65, 0x5f, 0x0a, 0x66, 0x89, 0x4f, 0x94, 0x93, 0xb2, - 0xd6, 0x78, 0x4a, 0xbc, 0xe6, 0x3b, 0x97, 0xfb, 0xa3, 0xe2, 0x7b, 0xd1, 0x41, 0xaf, 0xc2, 0x69, - 0xe3, 0xbd, 0x62, 0xd5, 0x31, 0xf5, 0xc6, 0x24, 0x5d, 0x76, 0xa7, 0x33, 0xb0, 0xbb, 0xbb, 0x13, - 0x8f, 0x64, 0xdb, 0x84, 0x9a, 0xea, 0xa1, 0x63, 0xff, 0x5a, 0x29, 0xfb, 0xb5, 0xd4, 0x0a, 0xf3, - 0x55, 0xab, 0x67, 0xeb, 0xf7, 0xc1, 0xe3, 0xd0, 0xea, 0x6c, 0x93, 0xa8, 0x0e, 0xf2, 0xfb, 0xe3, - 0x3c, 0xc0, 0x93, 0x42, 0xfb, 0x5f, 0x54, 0xe0, 0x1e, 0x92, 0xa9, 0xb3, 0x20, 0xab, 0xdf, 0x59, - 0xd0, 0xc1, 0x8f, 0x97, 0x3e, 0x67, 0xc1, 0x90, 0x4f, 0xad, 0x50, 0x7e, 0xde, 0x31, 0x72, 0xb1, - 0x79, 0x5c, 0x7d, 0xcf, 0x8d, 0xdd, 0x98, 0x9f, 0x56, 0x2b, 0x97, 0x27, 0x6f, 0xc4, 0x42, 0x06, - 0xf4, 0x75, 0x2b, 0x7d, 0x78, 0xc2, 0xc3, 0x8f, 0xbc, 0x63, 0x93, 0xc9, 0x38, 0x91, 0xe1, 0x82, - 0x69, 0x5f, 0x7f, 0x9f, 0xb3, 0x1a, 0x34, 0x09, 0xb0, 0xee, 0x05, 0x8e, 0xef, 0xbd, 0x49, 0x77, - 0xd3, 0x55, 0xb6, 0xac, 0xb0, 0x75, 0xfa, 0xb2, 0x6a, 0xc5, 0x06, 0xc6, 0xf9, 0x3f, 0x07, 0x23, - 0xc6, 0x9b, 0xe7, 0x1c, 0xb2, 0x9f, 0x35, 0x0f, 0xd9, 0xeb, 0xc6, 0xd9, 0xf8, 0xf9, 0xf7, 0xc3, - 0xe9, 0xac, 0x80, 0x07, 0x79, 0xde, 0xfe, 0x9f, 0xc3, 0xd9, 0x13, 0x8f, 0x55, 0x12, 0xb5, 0xa9, - 0x68, 0x6f, 0x7b, 0x21, 0xde, 0xf6, 0x42, 0xbc, 0xed, 0x85, 0x30, 0x1d, 0xc9, 0x62, 0x87, 0x3d, - 0x7c, 0x9f, 0x76, 0xd8, 0x29, 0x9f, 0x41, 0xad, 0x70, 0x9f, 0x81, 0xbd, 0x57, 0x85, 0x94, 0x1d, - 0xc5, 0xfb, 0xfb, 0xdd, 0x30, 0x1c, 0x91, 0x4e, 0x78, 0x03, 0x2f, 0x88, 0x35, 0x44, 0x07, 0x52, - 0xf3, 0x66, 0x2c, 0xe1, 0x74, 0xad, 0xe9, 0x38, 0xc9, 0x86, 0x58, 0x44, 0xd4, 0x5a, 0xb3, 0xec, - 0x24, 0x1b, 0x98, 0x41, 0xd0, 0xfb, 0xe1, 0x64, 0xe2, 0x44, 0x2d, 0x92, 0x60, 0xb2, 0xc5, 0x3e, - 0xab, 0x38, 0x17, 0x7b, 0x44, 0xe0, 0x9e, 0x5c, 0x4d, 0x41, 0x71, 0x06, 0x1b, 0xbd, 0x01, 0x95, - 0x0d, 0xe2, 0xb7, 0x45, 0x97, 0xaf, 0x14, 0xa7, 0xe3, 0xd9, 0xbb, 0x5e, 0x21, 0x7e, 0x9b, 0x6b, - 0x20, 0xfa, 0x0b, 0x33, 0x56, 0x74, 0xbc, 0xd5, 0x37, 0xbb, 0x71, 0x12, 0xb6, 0xbd, 0x37, 0xa5, - 0x3b, 0xe8, 0x83, 0x05, 0x33, 0xbe, 0x26, 0xe9, 0x73, 0x07, 0x82, 0xfa, 0x8b, 0x35, 0x67, 0x26, - 0x47, 0xd3, 0x8b, 0xd8, 0xa7, 0xda, 0x11, 0x5e, 0x9d, 0xa2, 0xe5, 0x98, 0x95, 0xf4, 0xb9, 0x1c, - 0xea, 0x2f, 0xd6, 0x9c, 0xd1, 0x8e, 0x1a, 0xf7, 0x23, 0x4c, 0x86, 0x1b, 0x05, 0xcb, 0xc0, 0xc7, - 0x7c, 0xee, 0xf8, 0x7f, 0x0a, 0xaa, 0xee, 0x86, 0x13, 0x25, 0xe3, 0xa3, 0x6c, 0xd0, 0x28, 0x47, - 0xc6, 0x0c, 0x6d, 0xc4, 0x1c, 0x86, 0x9e, 0x80, 0x72, 0x44, 0xd6, 0x59, 0xfc, 0x9e, 0x11, 0xd9, - 0x81, 0xc9, 0x3a, 0xa6, 0xed, 0xf6, 0xaf, 0x94, 0xd2, 0xe6, 0x52, 0xfa, 0xbd, 0xf9, 0x68, 0x77, - 0xbb, 0x51, 0x2c, 0x9d, 0x1d, 0xc6, 0x68, 0x67, 0xcd, 0x58, 0xc2, 0xd1, 0xa7, 0x2c, 0x18, 0xbe, - 0x1d, 0x87, 0x41, 0x40, 0x12, 0xb1, 0x34, 0xdd, 0x2c, 0xb8, 0x2b, 0xae, 0x72, 0xea, 0x5a, 0x06, - 0xd1, 0x80, 0x25, 0x5f, 0x2a, 0x2e, 0xd9, 0x76, 0xfd, 0x6e, 0xb3, 0xe7, 0x40, 0xff, 0x12, 0x6f, - 0xc6, 0x12, 0x4e, 0x51, 0xbd, 0x80, 0xa3, 0x56, 0xd2, 0xa8, 0xf3, 0x81, 0x40, 0x15, 0x70, 0xfb, - 0x2f, 0x0f, 0xc1, 0xb9, 0xdc, 0xc9, 0x41, 0x0d, 0x19, 0x66, 0x2a, 0x5c, 0xf6, 0x7c, 0x22, 0xc3, - 0x54, 0x98, 0x21, 0x73, 0x53, 0xb5, 0x62, 0x03, 0x03, 0xfd, 0x34, 0x40, 0xc7, 0x89, 0x9c, 0x36, - 0x11, 0x0b, 0x78, 0xf9, 0xe8, 0xf6, 0x02, 0x95, 0x63, 0x59, 0xd2, 0xd4, 0x7b, 0x53, 0xd5, 0x14, - 0x63, 0x83, 0x25, 0x7a, 0x11, 0x46, 0x22, 0xe2, 0x13, 0x27, 0x66, 0xe1, 0x9f, 0xd9, 0x58, 0x76, - 0xac, 0x41, 0xd8, 0xc4, 0x43, 0x4f, 0xab, 0x88, 0x9e, 0x4c, 0xf4, 0x43, 0x3a, 0xaa, 0x07, 0x7d, - 0xd1, 0x82, 0x93, 0xeb, 0x9e, 0x4f, 0x34, 0x77, 0x11, 0x79, 0xbe, 0x74, 0xf4, 0x97, 0xbc, 0x6c, - 0xd2, 0xd5, 0x1a, 0x32, 0xd5, 0x1c, 0xe3, 0x0c, 0x7b, 0xfa, 0x99, 0xb7, 0x48, 0xc4, 0x54, 0xeb, - 0x50, 0xfa, 0x33, 0xdf, 0xe4, 0xcd, 0x58, 0xc2, 0xd1, 0x34, 0x9c, 0xea, 0x38, 0x71, 0x3c, 0x13, - 0x91, 0x26, 0x09, 0x12, 0xcf, 0xf1, 0x79, 0x5c, 0x78, 0x4d, 0xc7, 0x85, 0x2e, 0xa7, 0xc1, 0x38, - 0x8b, 0x8f, 0x3e, 0x04, 0x8f, 0x7a, 0xad, 0x20, 0x8c, 0xc8, 0xa2, 0x17, 0xc7, 0x5e, 0xd0, 0xd2, - 0xc3, 0x40, 0x38, 0x3d, 0x26, 0x04, 0xa9, 0x47, 0xe7, 0xf3, 0xd1, 0x70, 0xbf, 0xe7, 0xd1, 0xb3, - 0x50, 0x8b, 0x37, 0xbd, 0xce, 0x4c, 0xd4, 0x8c, 0x99, 0x83, 0xbc, 0xa6, 0x5d, 0x6c, 0x2b, 0xa2, - 0x1d, 0x2b, 0x0c, 0xe4, 0xc2, 0x28, 0xff, 0x24, 0x3c, 0x6c, 0x49, 0xe8, 0xc7, 0xe7, 0xfa, 0x2e, - 0x8f, 0x22, 0x75, 0x69, 0x12, 0x3b, 0x77, 0x2e, 0x49, 0x77, 0x7d, 0xe3, 0xf4, 0xde, 0xee, 0xc4, - 0xe8, 0x4d, 0x83, 0x0c, 0x4e, 0x11, 0xb5, 0x7f, 0xa9, 0x94, 0xde, 0x71, 0x9b, 0x93, 0x14, 0xc5, - 0x74, 0x2a, 0x26, 0x37, 0x9d, 0x48, 0x7a, 0x63, 0x8e, 0x18, 0xbe, 0x2e, 0xe8, 0xde, 0x74, 0x22, - 0x73, 0x52, 0x33, 0x06, 0x58, 0x72, 0x42, 0xb7, 0xa1, 0x92, 0xf8, 0x4e, 0x41, 0xf9, 0x2e, 0x06, - 0x47, 0xed, 0x00, 0x59, 0x98, 0x8e, 0x31, 0xe3, 0x81, 0x1e, 0xa7, 0x56, 0xff, 0x9a, 0x8c, 0x71, - 0x13, 0x86, 0xfa, 0x5a, 0x8c, 0x59, 0xab, 0xfd, 0x7f, 0x6b, 0x39, 0x7a, 0x55, 0x2d, 0x64, 0xe8, - 0x22, 0x00, 0xdd, 0x40, 0x2e, 0x47, 0x64, 0xdd, 0xdb, 0x16, 0x86, 0x84, 0x9a, 0xbb, 0xd7, 0x15, - 0x04, 0x1b, 0x58, 0xf2, 0x99, 0x95, 0xee, 0x3a, 0x7d, 0xa6, 0xd4, 0xfb, 0x0c, 0x87, 0x60, 0x03, - 0x0b, 0xbd, 0x00, 0x43, 0x5e, 0xdb, 0x69, 0xa9, 0x50, 0xbc, 0xc7, 0xe9, 0xa4, 0x9d, 0x67, 0x2d, - 0x77, 0x77, 0x27, 0x4e, 0x2a, 0x81, 0x58, 0x13, 0x16, 0xb8, 0xe8, 0xd7, 0x2c, 0x18, 0x75, 0xc3, - 0x76, 0x3b, 0x0c, 0xf8, 0xb6, 0x4b, 0xec, 0x21, 0x6f, 0x1f, 0xd7, 0x32, 0x3f, 0x39, 0x63, 0x30, - 0xe3, 0x9b, 0x48, 0x95, 0x98, 0x63, 0x82, 0x70, 0x4a, 0x2a, 0x73, 0x6e, 0x57, 0xf7, 0x99, 0xdb, - 0xbf, 0x69, 0xc1, 0x18, 0x7f, 0xd6, 0xd8, 0x0d, 0x8a, 0x1c, 0x94, 0xf0, 0x98, 0x5f, 0xab, 0x67, - 0x83, 0xac, 0xbc, 0x74, 0x3d, 0x70, 0xdc, 0x2b, 0x24, 0x9a, 0x83, 0xb1, 0xf5, 0x30, 0x72, 0x89, - 0xd9, 0x11, 0x42, 0x31, 0x29, 0x42, 0x97, 0xb3, 0x08, 0xb8, 0xf7, 0x19, 0x74, 0x13, 0x1e, 0x31, - 0x1a, 0xcd, 0x7e, 0xe0, 0xba, 0xe9, 0x49, 0x41, 0xed, 0x91, 0xcb, 0xb9, 0x58, 0xb8, 0xcf, 0xd3, - 0x69, 0x87, 0x49, 0x7d, 0x00, 0x87, 0xc9, 0xeb, 0xf0, 0x98, 0xdb, 0xdb, 0x33, 0x5b, 0x71, 0x77, - 0x2d, 0xe6, 0x9a, 0xaa, 0xd6, 0xf8, 0x21, 0x41, 0xe0, 0xb1, 0x99, 0x7e, 0x88, 0xb8, 0x3f, 0x0d, - 0xf4, 0x31, 0xa8, 0x45, 0x84, 0x7d, 0x95, 0x58, 0x24, 0x64, 0x1c, 0x71, 0x97, 0xac, 0x2d, 0x50, - 0x4e, 0x56, 0xeb, 0x5e, 0xd1, 0x10, 0x63, 0xc5, 0xf1, 0xfc, 0x07, 0x60, 0xac, 0x67, 0x3c, 0x1f, - 0xc8, 0x67, 0x31, 0x0b, 0x8f, 0xe4, 0x8f, 0x9c, 0x03, 0x79, 0x2e, 0xfe, 0x41, 0x26, 0xce, 0xd0, - 0xb0, 0x26, 0x07, 0xf0, 0x82, 0x39, 0x50, 0x26, 0xc1, 0x96, 0x50, 0xa4, 0x97, 0x8f, 0xd6, 0x7b, - 0x97, 0x82, 0x2d, 0x3e, 0xf0, 0xd9, 0x56, 0xff, 0x52, 0xb0, 0x85, 0x29, 0x6d, 0xf4, 0x65, 0x2b, - 0x65, 0x0d, 0x71, 0xdf, 0xd9, 0x47, 0x8e, 0xc5, 0x7c, 0x1e, 0xd8, 0x40, 0xb2, 0xff, 0x65, 0x09, - 0x2e, 0xec, 0x47, 0x64, 0x80, 0xee, 0x7b, 0x0a, 0x86, 0x62, 0x76, 0x04, 0x2a, 0x34, 0xd3, 0x08, - 0xd5, 0x4a, 0xfc, 0x50, 0xf4, 0x75, 0x2c, 0x40, 0xc8, 0x87, 0x72, 0xdb, 0xe9, 0x08, 0x97, 0xca, - 0xfc, 0x51, 0xb3, 0x0a, 0xe8, 0x7f, 0xc7, 0x5f, 0x74, 0x3a, 0x7c, 0xa3, 0x6e, 0x34, 0x60, 0xca, - 0x06, 0x25, 0x50, 0x75, 0xa2, 0xc8, 0x91, 0xe7, 0x6d, 0xd7, 0x8a, 0xe1, 0x37, 0x4d, 0x49, 0x36, - 0xc6, 0xf6, 0x76, 0x27, 0x4e, 0xa4, 0x9a, 0x30, 0x67, 0x66, 0x7f, 0x6e, 0x38, 0x15, 0x59, 0xcf, - 0x0e, 0x51, 0x63, 0x18, 0x12, 0x9e, 0x14, 0xab, 0xe8, 0x64, 0x0e, 0x9e, 0x1a, 0xc5, 0x36, 0x4b, - 0x22, 0xc1, 0x54, 0xb0, 0x42, 0x9f, 0xb5, 0x58, 0x1a, 0xa7, 0xcc, 0x36, 0x10, 0x5b, 0x94, 0xe3, - 0xc9, 0x2a, 0x35, 0x93, 0x43, 0x65, 0x23, 0x36, 0xb9, 0xd3, 0xa5, 0xab, 0xc3, 0x13, 0x92, 0xb2, - 0x1b, 0x15, 0x99, 0xe8, 0x29, 0xe1, 0x68, 0x3b, 0xe7, 0xb0, 0xb4, 0x80, 0x54, 0xc0, 0x01, 0x8e, - 0x47, 0xbf, 0x6e, 0xc1, 0x18, 0x37, 0x47, 0x67, 0xbd, 0xf5, 0x75, 0x12, 0x91, 0xc0, 0x25, 0xd2, - 0xa0, 0x3f, 0xe2, 0x71, 0xbc, 0x74, 0x5f, 0xcd, 0x67, 0xc9, 0xeb, 0x35, 0xad, 0x07, 0x84, 0x7b, - 0x85, 0x41, 0x4d, 0xa8, 0x78, 0xc1, 0x7a, 0x28, 0x56, 0xf2, 0xc6, 0xd1, 0x84, 0x9a, 0x0f, 0xd6, - 0x43, 0x3d, 0x9b, 0xe9, 0x3f, 0xcc, 0xa8, 0xa3, 0x05, 0x38, 0x1b, 0x09, 0x97, 0xcb, 0x15, 0x2f, - 0xa6, 0x1b, 0xe3, 0x05, 0xaf, 0xed, 0x25, 0x6c, 0x15, 0x2e, 0x37, 0xc6, 0xf7, 0x76, 0x27, 0xce, - 0xe2, 0x1c, 0x38, 0xce, 0x7d, 0x0a, 0xbd, 0x09, 0xc3, 0x32, 0xef, 0xb4, 0x56, 0xc4, 0xe6, 0xa8, - 0x77, 0xfc, 0xab, 0xc1, 0xb4, 0x22, 0x52, 0x4c, 0x25, 0x43, 0xfb, 0x8b, 0x23, 0xd0, 0x7b, 0x36, - 0x88, 0x3e, 0x0e, 0xf5, 0x48, 0xe5, 0xc2, 0x5a, 0x45, 0xc4, 0xf7, 0xc9, 0xef, 0x2b, 0xce, 0x25, - 0x95, 0x3d, 0xa0, 0xb3, 0x5e, 0x35, 0x47, 0x6a, 0xb5, 0xc7, 0xfa, 0x08, 0xb1, 0x80, 0xb1, 0x2d, - 0xb8, 0xea, 0xe3, 0xa1, 0x9d, 0xc0, 0xc5, 0x8c, 0x07, 0x8a, 0x60, 0x68, 0x83, 0x38, 0x7e, 0xb2, - 0x51, 0x8c, 0x27, 0xfb, 0x0a, 0xa3, 0x95, 0xcd, 0x9a, 0xe0, 0xad, 0x58, 0x70, 0x42, 0xdb, 0x30, - 0xbc, 0xc1, 0x07, 0x80, 0x30, 0xa4, 0x17, 0x8f, 0xda, 0xb9, 0xa9, 0x51, 0xa5, 0x3f, 0xb7, 0x68, - 0xc0, 0x92, 0x1d, 0x8b, 0xb4, 0x30, 0x8e, 0xc5, 0xf9, 0xd4, 0x2d, 0x2e, 0x61, 0x64, 0xf0, 0x33, - 0xf1, 0x8f, 0xc2, 0x68, 0x44, 0xdc, 0x30, 0x70, 0x3d, 0x9f, 0x34, 0xa7, 0xa5, 0x97, 0xfa, 0x20, - 0x69, 0x06, 0x6c, 0x33, 0x8a, 0x0d, 0x1a, 0x38, 0x45, 0x11, 0x7d, 0xc6, 0x82, 0x93, 0x2a, 0x81, - 0x8e, 0x7e, 0x10, 0x22, 0xbc, 0xa2, 0x0b, 0x05, 0xa5, 0xeb, 0x31, 0x9a, 0x0d, 0xb4, 0xb7, 0x3b, - 0x71, 0x32, 0xdd, 0x86, 0x33, 0x7c, 0xd1, 0xab, 0x00, 0xe1, 0x1a, 0x0f, 0xa7, 0x98, 0x4e, 0x84, - 0x8b, 0xf4, 0x20, 0xaf, 0x7a, 0x92, 0xe7, 0x1b, 0x49, 0x0a, 0xd8, 0xa0, 0x86, 0xae, 0x01, 0xf0, - 0x69, 0xb3, 0xba, 0xd3, 0x91, 0xd6, 0xb6, 0xcc, 0x13, 0x81, 0x15, 0x05, 0xb9, 0xbb, 0x3b, 0xd1, - 0xeb, 0xb2, 0x62, 0xa7, 0xf7, 0xc6, 0xe3, 0xe8, 0xa7, 0x60, 0x38, 0xee, 0xb6, 0xdb, 0x8e, 0x72, - 0xa0, 0x16, 0x98, 0xc1, 0xc4, 0xe9, 0x1a, 0xaa, 0x88, 0x37, 0x60, 0xc9, 0x11, 0xdd, 0xa6, 0x4a, - 0x35, 0x16, 0xbe, 0x34, 0x36, 0x8b, 0xb8, 0x4d, 0x30, 0xc2, 0xde, 0xe9, 0x7d, 0x32, 0x3a, 0x04, - 0xe7, 0xe0, 0xdc, 0xdd, 0x9d, 0x78, 0x24, 0xdd, 0xbe, 0x10, 0x8a, 0x9c, 0xa2, 0x5c, 0x9a, 0xe8, - 0xaa, 0x2c, 0x43, 0x41, 0x5f, 0x5b, 0x66, 0x47, 0x3f, 0xa3, 0xcb, 0x50, 0xb0, 0xe6, 0xfe, 0x7d, - 0x66, 0x3e, 0x8c, 0x16, 0xe1, 0x8c, 0x1b, 0x06, 0x49, 0x14, 0xfa, 0x3e, 0xaf, 0xad, 0xc2, 0x37, - 0x3e, 0xdc, 0xc1, 0xfa, 0x4e, 0x21, 0xf6, 0x99, 0x99, 0x5e, 0x14, 0x9c, 0xf7, 0x9c, 0x1d, 0xa4, - 0xe3, 0xcc, 0x44, 0xe7, 0xbc, 0x00, 0xa3, 0x64, 0x3b, 0x21, 0x51, 0xe0, 0xf8, 0x37, 0xf0, 0x82, - 0x74, 0x2d, 0xb2, 0x39, 0x70, 0xc9, 0x68, 0xc7, 0x29, 0x2c, 0x64, 0xab, 0xdd, 0x7e, 0x49, 0x27, - 0xde, 0xf1, 0xdd, 0xbe, 0xdc, 0xdb, 0xdb, 0xff, 0xab, 0x94, 0x32, 0xc8, 0x56, 0x23, 0x42, 0x50, - 0x08, 0xd5, 0x20, 0x6c, 0x2a, 0xdd, 0x7f, 0xb5, 0x18, 0xdd, 0x7f, 0x3d, 0x6c, 0x1a, 0xb5, 0x2a, - 0xe8, 0xbf, 0x18, 0x73, 0x3e, 0x2c, 0x99, 0x5f, 0x56, 0x3d, 0x60, 0x00, 0xb1, 0xd1, 0x28, 0x92, - 0xb3, 0x4a, 0xe6, 0x5f, 0x32, 0x19, 0xe1, 0x34, 0x5f, 0xb4, 0x09, 0xd5, 0x8d, 0x30, 0x4e, 0xe4, - 0xf6, 0xe3, 0x88, 0x3b, 0x9d, 0x2b, 0x61, 0x9c, 0x30, 0x2b, 0x42, 0xbd, 0x36, 0x6d, 0x89, 0x31, - 0xe7, 0x61, 0xff, 0x47, 0x2b, 0xe5, 0x48, 0xbe, 0xc5, 0x62, 0x2e, 0xb7, 0x48, 0x40, 0xa7, 0xb5, - 0x19, 0x6f, 0xf3, 0x67, 0x33, 0x89, 0x5f, 0xef, 0xea, 0x57, 0x39, 0xe8, 0x0e, 0xa5, 0x30, 0xc9, - 0x48, 0x18, 0xa1, 0x39, 0x9f, 0xb4, 0xd2, 0x29, 0x78, 0xa5, 0x22, 0x36, 0x18, 0x66, 0x8a, 0xe9, - 0xbe, 0xd9, 0x7c, 0xf6, 0x97, 0x2d, 0x18, 0x6e, 0x38, 0xee, 0x66, 0xb8, 0xbe, 0x8e, 0x9e, 0x85, - 0x5a, 0xb3, 0x1b, 0x99, 0xd9, 0x80, 0x6a, 0xf7, 0x3c, 0x2b, 0xda, 0xb1, 0xc2, 0xa0, 0x63, 0x78, - 0xdd, 0x71, 0x65, 0xa2, 0x69, 0x99, 0x8f, 0xe1, 0xcb, 0xac, 0x05, 0x0b, 0x08, 0x7a, 0x11, 0x46, - 0xda, 0xce, 0xb6, 0x7c, 0x38, 0xeb, 0xc5, 0x5e, 0xd4, 0x20, 0x6c, 0xe2, 0xd9, 0xff, 0xcc, 0x82, - 0xf1, 0x86, 0x13, 0x7b, 0xee, 0x74, 0x37, 0xd9, 0x68, 0x78, 0xc9, 0x5a, 0xd7, 0xdd, 0x24, 0x09, - 0xcf, 0x2e, 0xa6, 0x52, 0x76, 0x63, 0x3a, 0x95, 0xd4, 0xbe, 0x4e, 0x49, 0x79, 0x43, 0xb4, 0x63, - 0x85, 0x81, 0xde, 0x84, 0x91, 0x8e, 0x13, 0xc7, 0x77, 0xc2, 0xa8, 0x89, 0xc9, 0x7a, 0x31, 0xb9, - 0xfd, 0x2b, 0xc4, 0x8d, 0x48, 0x82, 0xc9, 0xba, 0x38, 0x69, 0xd5, 0xf4, 0xb1, 0xc9, 0xcc, 0xfe, - 0x82, 0x05, 0x8f, 0x35, 0x88, 0x13, 0x91, 0x88, 0x95, 0x02, 0x50, 0x2f, 0x32, 0xe3, 0x87, 0xdd, - 0x26, 0x7a, 0x03, 0x6a, 0x09, 0x6d, 0xa6, 0x62, 0x59, 0xc5, 0x8a, 0xc5, 0x0e, 0x4a, 0x57, 0x05, - 0x71, 0xac, 0xd8, 0xd8, 0x7f, 0xc5, 0x82, 0x51, 0x76, 0xe6, 0x34, 0x4b, 0x12, 0xc7, 0xf3, 0x7b, - 0x2a, 0xe6, 0x58, 0x03, 0x56, 0xcc, 0xb9, 0x00, 0x95, 0x8d, 0xb0, 0x4d, 0xb2, 0xe7, 0xa5, 0x57, - 0x42, 0xba, 0xad, 0xa6, 0x10, 0xf4, 0x3c, 0xfd, 0xf0, 0x5e, 0x90, 0x38, 0x74, 0x0a, 0x48, 0x9f, - 0xe6, 0x29, 0xfe, 0xd1, 0x55, 0x33, 0x36, 0x71, 0xec, 0xdf, 0xa9, 0xc3, 0xb0, 0x38, 0x54, 0x1f, - 0x38, 0xc3, 0x5c, 0xee, 0xef, 0x4b, 0x7d, 0xf7, 0xf7, 0x31, 0x0c, 0xb9, 0xac, 0x1e, 0x97, 0x30, - 0x23, 0xaf, 0x15, 0x12, 0x85, 0xc1, 0x4b, 0x7c, 0x69, 0xb1, 0xf8, 0x7f, 0x2c, 0x58, 0xa1, 0x2f, - 0x59, 0x70, 0xca, 0x0d, 0x83, 0x80, 0xb8, 0xda, 0xc6, 0xa9, 0x14, 0x71, 0xd8, 0x3e, 0x93, 0x26, - 0xaa, 0x0f, 0x3c, 0x32, 0x00, 0x9c, 0x65, 0x8f, 0x5e, 0x86, 0x13, 0xbc, 0xcf, 0x6e, 0xa6, 0x1c, - 0xb1, 0xba, 0x90, 0x8a, 0x09, 0xc4, 0x69, 0x5c, 0x34, 0xc9, 0x1d, 0xda, 0xa2, 0x64, 0xc9, 0x90, - 0x3e, 0x3d, 0x33, 0x8a, 0x95, 0x18, 0x18, 0x28, 0x02, 0x14, 0x91, 0xf5, 0x88, 0xc4, 0x1b, 0x22, - 0xe8, 0x80, 0xd9, 0x57, 0xc3, 0x87, 0xcb, 0x58, 0xc5, 0x3d, 0x94, 0x70, 0x0e, 0x75, 0xb4, 0x29, - 0x36, 0x98, 0xb5, 0x22, 0x74, 0xa8, 0xf8, 0xcc, 0x7d, 0xf7, 0x99, 0x13, 0x50, 0x8d, 0x37, 0x9c, - 0xa8, 0xc9, 0xec, 0xba, 0x32, 0xcf, 0x92, 0x58, 0xa1, 0x0d, 0x98, 0xb7, 0xa3, 0x59, 0x38, 0x9d, - 0x29, 0x03, 0x13, 0x0b, 0x87, 0xa9, 0x0a, 0xed, 0xcf, 0x14, 0x90, 0x89, 0x71, 0xcf, 0x13, 0xa6, - 0xf3, 0x61, 0x64, 0x1f, 0xe7, 0xc3, 0x8e, 0x0a, 0x6d, 0x1b, 0x65, 0xeb, 0xe3, 0x2b, 0x85, 0x74, - 0xc0, 0x40, 0x71, 0x6c, 0x9f, 0xcf, 0xc4, 0xb1, 0x9d, 0x60, 0x02, 0xdc, 0x2c, 0x46, 0x80, 0x83, - 0x07, 0xad, 0x3d, 0xc8, 0x20, 0xb4, 0xff, 0x61, 0x81, 0xfc, 0xae, 0x33, 0x8e, 0xbb, 0x41, 0xe8, - 0x90, 0x41, 0xef, 0x87, 0x93, 0x6a, 0x0b, 0x3d, 0x13, 0x76, 0x03, 0x1e, 0x7f, 0x56, 0xd6, 0x27, - 0xa3, 0x38, 0x05, 0xc5, 0x19, 0x6c, 0x34, 0x05, 0x75, 0xda, 0x4f, 0xfc, 0x51, 0xbe, 0xd6, 0xaa, - 0x6d, 0xfa, 0xf4, 0xf2, 0xbc, 0x78, 0x4a, 0xe3, 0xa0, 0x10, 0xc6, 0x7c, 0x27, 0x4e, 0x98, 0x04, - 0x74, 0x47, 0x7d, 0xc8, 0x7c, 0x71, 0x16, 0x3f, 0xbe, 0x90, 0x25, 0x84, 0x7b, 0x69, 0xdb, 0xdf, - 0xa9, 0xc0, 0x89, 0x94, 0x66, 0x3c, 0xe0, 0x22, 0xfd, 0x2c, 0xd4, 0xe4, 0xba, 0x99, 0xad, 0x5a, - 0xa1, 0x16, 0x57, 0x85, 0x41, 0x17, 0xad, 0x35, 0xbd, 0xaa, 0x66, 0x8d, 0x0a, 0x63, 0xc1, 0xc5, - 0x26, 0x1e, 0x53, 0xca, 0x89, 0x1f, 0xcf, 0xf8, 0x1e, 0x09, 0x12, 0x2e, 0x66, 0x31, 0x4a, 0x79, - 0x75, 0x61, 0xc5, 0x24, 0xaa, 0x95, 0x72, 0x06, 0x80, 0xb3, 0xec, 0xd1, 0xcf, 0x5a, 0x70, 0xc2, - 0xb9, 0x13, 0xeb, 0xa2, 0x91, 0x22, 0x62, 0xed, 0x88, 0x8b, 0x54, 0xaa, 0x0e, 0x25, 0x77, 0xf9, - 0xa6, 0x9a, 0x70, 0x9a, 0x29, 0xfa, 0xaa, 0x05, 0x88, 0x6c, 0x13, 0x57, 0xc6, 0xd4, 0x09, 0x59, - 0x86, 0x8a, 0xd8, 0x69, 0x5e, 0xea, 0xa1, 0xcb, 0xb5, 0x7a, 0x6f, 0x3b, 0xce, 0x91, 0xc1, 0xfe, - 0xc7, 0x65, 0x35, 0xa1, 0x74, 0x18, 0xa7, 0x63, 0x84, 0x93, 0x59, 0x87, 0x0f, 0x27, 0xd3, 0xc7, - 0xf2, 0xbd, 0x69, 0x68, 0xa9, 0xf4, 0x9b, 0xd2, 0x03, 0x4a, 0xbf, 0xf9, 0x19, 0x2b, 0x55, 0x9f, - 0x65, 0xe4, 0xe2, 0xab, 0xc5, 0x86, 0x90, 0x4e, 0xf2, 0x90, 0x81, 0x8c, 0x76, 0x4f, 0x47, 0x8a, - 0x50, 0x6d, 0x6a, 0xa0, 0x1d, 0x48, 0x1b, 0xfe, 0xdb, 0x32, 0x8c, 0x18, 0x2b, 0x69, 0xae, 0x59, - 0x64, 0x3d, 0x64, 0x66, 0x51, 0xe9, 0x00, 0x66, 0xd1, 0x4f, 0x43, 0xdd, 0x95, 0x5a, 0xbe, 0x98, - 0x0a, 0xa5, 0xd9, 0xb5, 0x43, 0x2b, 0x7a, 0xd5, 0x84, 0x35, 0x4f, 0x34, 0x97, 0xca, 0x5f, 0x11, - 0x2b, 0x44, 0x85, 0xad, 0x10, 0x79, 0x09, 0x26, 0x62, 0xa5, 0xe8, 0x7d, 0x86, 0x95, 0xf1, 0xe9, - 0x78, 0xe2, 0xbd, 0x64, 0xa0, 0x37, 0x2f, 0xe3, 0xb3, 0x3c, 0x2f, 0x9b, 0xb1, 0x89, 0x63, 0x7f, - 0xc7, 0x52, 0x1f, 0xf7, 0x3e, 0x24, 0xb5, 0xdf, 0x4e, 0x27, 0xb5, 0x5f, 0x2a, 0xa4, 0x9b, 0xfb, - 0x64, 0xb3, 0x5f, 0x87, 0xe1, 0x99, 0xb0, 0xdd, 0x76, 0x82, 0x26, 0xfa, 0x61, 0x18, 0x76, 0xf9, - 0x4f, 0xe1, 0xd8, 0x61, 0xc7, 0x83, 0x02, 0x8a, 0x25, 0x0c, 0x3d, 0x0e, 0x15, 0x27, 0x6a, 0x49, - 0x67, 0x0e, 0x8b, 0x30, 0x99, 0x8e, 0x5a, 0x31, 0x66, 0xad, 0xf6, 0xdf, 0xaf, 0x00, 0xcc, 0x84, - 0xed, 0x8e, 0x13, 0x91, 0xe6, 0x6a, 0xc8, 0x2a, 0xa4, 0x1d, 0xeb, 0xa1, 0x9a, 0xde, 0x2c, 0x3d, - 0xcc, 0x07, 0x6b, 0xc6, 0xe1, 0x4a, 0xf9, 0x3e, 0x1f, 0xae, 0xf4, 0x39, 0x2f, 0xab, 0x3c, 0x44, - 0xe7, 0x65, 0xf6, 0xe7, 0x2c, 0x40, 0x74, 0xd0, 0x84, 0x01, 0x09, 0x12, 0x7d, 0xa0, 0x3d, 0x05, - 0x75, 0x57, 0xb6, 0x0a, 0xc3, 0x4a, 0xab, 0x08, 0x09, 0xc0, 0x1a, 0x67, 0x80, 0x1d, 0xf2, 0x53, - 0x52, 0x7f, 0x97, 0xd3, 0xc1, 0xa9, 0x4c, 0xeb, 0x0b, 0x75, 0x6e, 0xff, 0x6e, 0x09, 0x1e, 0xe1, - 0x4b, 0xf2, 0xa2, 0x13, 0x38, 0x2d, 0xd2, 0xa6, 0x52, 0x0d, 0x1a, 0xa2, 0xe0, 0xd2, 0xad, 0x99, - 0x27, 0x83, 0x4d, 0x8f, 0x3a, 0x77, 0xf9, 0x9c, 0xe3, 0xb3, 0x6c, 0x3e, 0xf0, 0x12, 0xcc, 0x88, - 0xa3, 0x18, 0x6a, 0xb2, 0x24, 0xb7, 0xd0, 0xc5, 0x05, 0x31, 0x52, 0x6a, 0x49, 0xac, 0x9b, 0x04, - 0x2b, 0x46, 0xd4, 0x70, 0xf5, 0x43, 0x77, 0x13, 0x93, 0x4e, 0xc8, 0xf4, 0xae, 0x11, 0xeb, 0xb7, - 0x20, 0xda, 0xb1, 0xc2, 0xb0, 0x7f, 0xd7, 0x82, 0xec, 0x8a, 0x64, 0x94, 0xab, 0xb2, 0xee, 0x59, - 0xae, 0xea, 0x00, 0xf5, 0xa2, 0x7e, 0x12, 0x46, 0x9c, 0x84, 0x1a, 0x11, 0x7c, 0xdb, 0x5d, 0x3e, - 0xdc, 0xb1, 0xc6, 0x62, 0xd8, 0xf4, 0xd6, 0x3d, 0xb6, 0xdd, 0x36, 0xc9, 0xd9, 0xff, 0xad, 0x02, - 0x63, 0x3d, 0x29, 0x11, 0xe8, 0x25, 0x18, 0x75, 0xc5, 0xf0, 0xe8, 0x48, 0x87, 0x56, 0xdd, 0x8c, - 0x0d, 0xd3, 0x30, 0x9c, 0xc2, 0x1c, 0x60, 0x80, 0xce, 0xc3, 0x99, 0x88, 0x6e, 0xf4, 0xbb, 0x64, - 0x7a, 0x3d, 0x21, 0xd1, 0x0a, 0x71, 0xc3, 0xa0, 0xc9, 0x8b, 0xaa, 0x95, 0x1b, 0x8f, 0xee, 0xed, - 0x4e, 0x9c, 0xc1, 0xbd, 0x60, 0x9c, 0xf7, 0x0c, 0xea, 0xc0, 0x09, 0xdf, 0xb4, 0x01, 0xc5, 0x06, - 0xe0, 0x50, 0xe6, 0xa3, 0xb2, 0x11, 0x52, 0xcd, 0x38, 0xcd, 0x20, 0x6d, 0x48, 0x56, 0x1f, 0x90, - 0x21, 0xf9, 0x69, 0x6d, 0x48, 0xf2, 0xf3, 0xf7, 0x0f, 0x17, 0x9c, 0x12, 0x73, 0xdc, 0x96, 0xe4, - 0x2b, 0x50, 0x93, 0xb1, 0x49, 0x03, 0xc5, 0xf4, 0x98, 0x74, 0xfa, 0x68, 0xb4, 0xbb, 0x25, 0xc8, - 0xd9, 0x84, 0xd0, 0x79, 0xa6, 0x57, 0xfc, 0xd4, 0x3c, 0x3b, 0xd8, 0xaa, 0x8f, 0xb6, 0x79, 0x5c, - 0x16, 0x5f, 0xdb, 0x3e, 0x54, 0xf4, 0x26, 0x4a, 0x87, 0x6a, 0xa9, 0x4c, 0x01, 0x15, 0xae, 0x75, - 0x11, 0x40, 0x1b, 0x6a, 0x22, 0x0e, 0x5c, 0x1d, 0xfb, 0x6a, 0x7b, 0x0e, 0x1b, 0x58, 0x74, 0x4f, - 0xed, 0x05, 0x71, 0xe2, 0xf8, 0xfe, 0x15, 0x2f, 0x48, 0x84, 0x73, 0x50, 0x2d, 0xe2, 0xf3, 0x1a, - 0x84, 0x4d, 0xbc, 0xf3, 0xef, 0x33, 0xbe, 0xcb, 0x41, 0xbe, 0xe7, 0x06, 0x3c, 0x36, 0xe7, 0x25, - 0x2a, 0x7b, 0x41, 0x8d, 0x23, 0x6a, 0x87, 0xa9, 0x6c, 0x1c, 0xab, 0x6f, 0x36, 0x8e, 0x91, 0x3d, - 0x50, 0x4a, 0x27, 0x3b, 0x64, 0xb3, 0x07, 0xec, 0x97, 0xe0, 0xec, 0x9c, 0x97, 0x5c, 0xf6, 0x7c, - 0x72, 0x40, 0x26, 0xf6, 0x6f, 0x0f, 0xc1, 0xa8, 0x99, 0xff, 0x76, 0x90, 0x84, 0xa2, 0x2f, 0x50, - 0x53, 0x4b, 0xbc, 0x9d, 0xa7, 0x0e, 0xcd, 0x6e, 0x1d, 0x39, 0x19, 0x2f, 0xbf, 0xc7, 0x0c, 0x6b, - 0x4b, 0xf3, 0xc4, 0xa6, 0x00, 0xe8, 0x0e, 0x54, 0xd7, 0x59, 0x74, 0x7b, 0xb9, 0x88, 0xc8, 0x82, - 0xbc, 0x1e, 0xd5, 0xd3, 0x8c, 0xc7, 0xc7, 0x73, 0x7e, 0x74, 0x85, 0x8c, 0xd2, 0x29, 0x53, 0x46, - 0x44, 0xa6, 0x48, 0x96, 0x52, 0x18, 0xfd, 0x54, 0x7d, 0xf5, 0x10, 0xaa, 0x3e, 0xa5, 0x78, 0x87, - 0x1e, 0x90, 0xe2, 0x65, 0x99, 0x0a, 0xc9, 0x06, 0xb3, 0xdf, 0x44, 0x08, 0xf9, 0x30, 0xeb, 0x04, - 0x23, 0x53, 0x21, 0x05, 0xc6, 0x59, 0x7c, 0xf4, 0x09, 0xa5, 0xba, 0x6b, 0x45, 0xf8, 0x55, 0xcd, - 0x11, 0x7d, 0xdc, 0x5a, 0xfb, 0x73, 0x25, 0x38, 0x39, 0x17, 0x74, 0x97, 0xe7, 0x96, 0xbb, 0x6b, - 0xbe, 0xe7, 0x5e, 0x23, 0x3b, 0x54, 0x35, 0x6f, 0x92, 0x9d, 0xf9, 0x59, 0x31, 0x83, 0xd4, 0x98, - 0xb9, 0x46, 0x1b, 0x31, 0x87, 0x51, 0x65, 0xb4, 0xee, 0x05, 0x2d, 0x12, 0x75, 0x22, 0x4f, 0xb8, - 0x3c, 0x0d, 0x65, 0x74, 0x59, 0x83, 0xb0, 0x89, 0x47, 0x69, 0x87, 0x77, 0x02, 0x12, 0x65, 0x0d, - 0xd9, 0x25, 0xda, 0x88, 0x39, 0x8c, 0x22, 0x25, 0x51, 0x37, 0x4e, 0xc4, 0x60, 0x54, 0x48, 0xab, - 0xb4, 0x11, 0x73, 0x18, 0x9d, 0xe9, 0x71, 0x77, 0x8d, 0x05, 0x6e, 0x64, 0xe2, 0xd5, 0x57, 0x78, - 0x33, 0x96, 0x70, 0x8a, 0xba, 0x49, 0x76, 0x66, 0xe9, 0xae, 0x37, 0x93, 0xb6, 0x72, 0x8d, 0x37, - 0x63, 0x09, 0x67, 0xd5, 0xe0, 0xd2, 0xdd, 0xf1, 0x7d, 0x57, 0x0d, 0x2e, 0x2d, 0x7e, 0x9f, 0xfd, - 0xf3, 0xaf, 0x5a, 0x30, 0x6a, 0x86, 0x5b, 0xa1, 0x56, 0xc6, 0xc6, 0x5d, 0xea, 0x29, 0x26, 0xfa, - 0xe3, 0x79, 0x37, 0x27, 0xb5, 0xbc, 0x24, 0xec, 0xc4, 0xcf, 0x91, 0xa0, 0xe5, 0x05, 0x84, 0x9d, - 0xa2, 0xf3, 0x30, 0xad, 0x54, 0x2c, 0xd7, 0x4c, 0xd8, 0x24, 0x87, 0x30, 0x92, 0xed, 0x5b, 0x30, - 0xd6, 0x93, 0xab, 0x34, 0x80, 0x69, 0xb1, 0x6f, 0xa6, 0xa8, 0x8d, 0x61, 0x84, 0x12, 0x96, 0xa5, - 0x55, 0x66, 0x60, 0x8c, 0x4f, 0x24, 0xca, 0x69, 0xc5, 0xdd, 0x20, 0x6d, 0x95, 0x7f, 0xc6, 0xfc, - 0xeb, 0x37, 0xb3, 0x40, 0xdc, 0x8b, 0x6f, 0x7f, 0xde, 0x82, 0x13, 0xa9, 0xf4, 0xb1, 0x82, 0x8c, - 0x20, 0x36, 0xd3, 0x42, 0x16, 0xfd, 0xc7, 0x42, 0xa0, 0xcb, 0x6c, 0x31, 0xd5, 0x33, 0x4d, 0x83, - 0xb0, 0x89, 0x67, 0x7f, 0xb9, 0x04, 0x35, 0x19, 0x41, 0x31, 0x80, 0x28, 0x9f, 0xb5, 0xe0, 0x84, - 0x3a, 0xd3, 0x60, 0xce, 0xb2, 0x52, 0x11, 0xb1, 0xfe, 0x54, 0x02, 0xb5, 0xdd, 0x0e, 0xd6, 0x43, - 0x6d, 0x91, 0x63, 0x93, 0x19, 0x4e, 0xf3, 0x46, 0x37, 0x01, 0xe2, 0x9d, 0x38, 0x21, 0x6d, 0xc3, - 0x6d, 0x67, 0x1b, 0x33, 0x6e, 0xd2, 0x0d, 0x23, 0x42, 0xe7, 0xd7, 0xf5, 0xb0, 0x49, 0x56, 0x14, - 0xa6, 0x36, 0xa1, 0x74, 0x1b, 0x36, 0x28, 0xd9, 0x7f, 0xb7, 0x04, 0xa7, 0xb3, 0x22, 0xa1, 0x0f, - 0xc3, 0xa8, 0xe4, 0x6e, 0xdc, 0x02, 0x25, 0xc3, 0x46, 0x46, 0xb1, 0x01, 0xbb, 0xbb, 0x3b, 0x31, - 0xd1, 0x7b, 0x0b, 0xd7, 0xa4, 0x89, 0x82, 0x53, 0xc4, 0xf8, 0xc1, 0x92, 0x38, 0x01, 0x6d, 0xec, - 0x4c, 0x77, 0x3a, 0xe2, 0x74, 0xc8, 0x38, 0x58, 0x32, 0xa1, 0x38, 0x83, 0x8d, 0x96, 0xe1, 0xac, - 0xd1, 0x72, 0x9d, 0x78, 0xad, 0x8d, 0xb5, 0x30, 0x92, 0x3b, 0xab, 0xc7, 0x75, 0x60, 0x57, 0x2f, - 0x0e, 0xce, 0x7d, 0x92, 0xae, 0xf6, 0xae, 0xd3, 0x71, 0x5c, 0x2f, 0xd9, 0x11, 0x7e, 0x48, 0xa5, - 0x9b, 0x66, 0x44, 0x3b, 0x56, 0x18, 0xf6, 0x22, 0x54, 0x06, 0x1c, 0x41, 0x03, 0x59, 0xf4, 0xaf, - 0x40, 0x8d, 0x92, 0x93, 0xe6, 0x5d, 0x11, 0x24, 0x43, 0xa8, 0xc9, 0x8b, 0x1c, 0x90, 0x0d, 0x65, - 0xcf, 0x91, 0x67, 0x77, 0xea, 0xb5, 0xe6, 0xe3, 0xb8, 0xcb, 0x36, 0xc9, 0x14, 0x88, 0x9e, 0x82, - 0x32, 0xd9, 0xee, 0x64, 0x0f, 0xe9, 0x2e, 0x6d, 0x77, 0xbc, 0x88, 0xc4, 0x14, 0x89, 0x6c, 0x77, - 0xd0, 0x79, 0x28, 0x79, 0x4d, 0xb1, 0x48, 0x81, 0xc0, 0x29, 0xcd, 0xcf, 0xe2, 0x92, 0xd7, 0xb4, - 0xb7, 0xa1, 0xae, 0x6e, 0x8e, 0x40, 0x9b, 0x52, 0x77, 0x5b, 0x45, 0x84, 0x3c, 0x49, 0xba, 0x7d, - 0xb4, 0x76, 0x17, 0x40, 0xe7, 0xd1, 0x15, 0xa5, 0x5f, 0x2e, 0x40, 0xc5, 0x0d, 0x45, 0x8e, 0x6f, - 0x4d, 0x93, 0x61, 0x4a, 0x9b, 0x41, 0xec, 0x5b, 0x70, 0xf2, 0x5a, 0x10, 0xde, 0x61, 0xa5, 0xb1, - 0x59, 0x49, 0x2b, 0x4a, 0x78, 0x9d, 0xfe, 0xc8, 0x9a, 0x08, 0x0c, 0x8a, 0x39, 0x4c, 0x95, 0x3d, - 0x2a, 0xf5, 0x2b, 0x7b, 0x64, 0x7f, 0xd2, 0x82, 0xd3, 0x2a, 0x1b, 0x48, 0x6a, 0xe3, 0x97, 0x60, - 0x74, 0xad, 0xeb, 0xf9, 0x4d, 0x59, 0x28, 0x2b, 0xe3, 0xa6, 0x68, 0x18, 0x30, 0x9c, 0xc2, 0xa4, - 0x9b, 0xaa, 0x35, 0x2f, 0x70, 0xa2, 0x9d, 0x65, 0xad, 0xfe, 0x95, 0x46, 0x68, 0x28, 0x08, 0x36, - 0xb0, 0xec, 0xcf, 0x9a, 0x22, 0x88, 0xfc, 0xa3, 0x01, 0x7a, 0xf6, 0x06, 0x54, 0x5d, 0x75, 0xd6, - 0x7b, 0xa8, 0x62, 0x7e, 0x2a, 0xbf, 0x9c, 0xf9, 0xfb, 0x39, 0x35, 0xfb, 0x9f, 0x94, 0xe0, 0x44, - 0xaa, 0x66, 0x09, 0xf2, 0xa1, 0x46, 0x7c, 0xe6, 0xca, 0x93, 0x43, 0xec, 0xa8, 0xe5, 0x22, 0xd5, - 0xb4, 0xb8, 0x24, 0xe8, 0x62, 0xc5, 0xe1, 0xe1, 0x38, 0x52, 0x7b, 0x09, 0x46, 0xa5, 0x40, 0x1f, - 0x72, 0xda, 0xbe, 0x98, 0x85, 0x6a, 0x00, 0x5c, 0x32, 0x60, 0x38, 0x85, 0x69, 0xff, 0x5e, 0x19, - 0xc6, 0xb9, 0xef, 0xb3, 0xa9, 0xa2, 0x5e, 0x16, 0xa5, 0x95, 0xf5, 0x17, 0x74, 0x65, 0x21, 0xde, - 0x91, 0x6b, 0x47, 0xad, 0xce, 0x9c, 0xcf, 0x68, 0xa0, 0x78, 0x8c, 0x5f, 0xce, 0xc4, 0x63, 0xf0, - 0xc5, 0xb6, 0x75, 0x4c, 0x12, 0x7d, 0x7f, 0x05, 0x68, 0xfc, 0xad, 0x12, 0x9c, 0xca, 0x94, 0xbe, - 0x46, 0x5f, 0x4c, 0x97, 0x7d, 0xb4, 0x8a, 0xf0, 0x90, 0xdd, 0xb3, 0x1a, 0xf2, 0xc1, 0x8a, 0x3f, - 0x3e, 0xa0, 0xa9, 0x62, 0xff, 0x7e, 0x09, 0x4e, 0xa6, 0x6b, 0x76, 0x3f, 0x84, 0x3d, 0xf5, 0x1e, - 0xa8, 0xb3, 0xb2, 0xb4, 0xec, 0x9e, 0x31, 0xee, 0x88, 0xe3, 0xa5, 0x4c, 0x65, 0x23, 0xd6, 0xf0, - 0x87, 0xa2, 0xa6, 0xa6, 0xfd, 0xb7, 0x2d, 0x38, 0xc7, 0xdf, 0x32, 0x3b, 0x0e, 0xff, 0x62, 0x5e, - 0xef, 0xbe, 0x56, 0xac, 0x80, 0x99, 0x8a, 0x58, 0xfb, 0xf5, 0x2f, 0xbb, 0xdf, 0x48, 0x48, 0x9b, - 0x1e, 0x0a, 0x0f, 0xa1, 0xb0, 0x07, 0x1a, 0x0c, 0xf6, 0xef, 0x97, 0x41, 0x5f, 0xe9, 0x84, 0x3c, - 0x91, 0xd9, 0x54, 0x48, 0x65, 0xb0, 0x95, 0x9d, 0xc0, 0xd5, 0x97, 0x47, 0xd5, 0x32, 0x89, 0x4d, - 0xbf, 0x60, 0xc1, 0x88, 0x17, 0x78, 0x89, 0xe7, 0x30, 0xe3, 0xb9, 0x98, 0x2b, 0x69, 0x14, 0xbb, - 0x79, 0x4e, 0x39, 0x8c, 0x4c, 0xef, 0xad, 0x62, 0x86, 0x4d, 0xce, 0xe8, 0xa3, 0x22, 0x64, 0xb2, - 0x5c, 0x58, 0x4e, 0x5e, 0x2d, 0x13, 0x27, 0xd9, 0x81, 0x6a, 0x44, 0x92, 0xa8, 0xa0, 0x54, 0x56, - 0x4c, 0x49, 0xa9, 0x22, 0x93, 0xfa, 0x72, 0x4d, 0xda, 0x8c, 0x39, 0x23, 0x3b, 0x06, 0xd4, 0xdb, - 0x17, 0x07, 0x0c, 0x47, 0x9b, 0x82, 0xba, 0xd3, 0x4d, 0xc2, 0x36, 0xed, 0x26, 0xe1, 0x60, 0xd6, - 0x01, 0x77, 0x12, 0x80, 0x35, 0x8e, 0xfd, 0xc5, 0x2a, 0x64, 0x52, 0x8d, 0xd0, 0xb6, 0x79, 0x1d, - 0x99, 0x55, 0xec, 0x75, 0x64, 0x4a, 0x98, 0xbc, 0x2b, 0xc9, 0x50, 0x0b, 0xaa, 0x9d, 0x0d, 0x27, - 0x96, 0xb6, 0xf1, 0x2b, 0xb2, 0x9b, 0x96, 0x69, 0xe3, 0xdd, 0xdd, 0x89, 0x9f, 0x18, 0xcc, 0xd7, - 0x42, 0xc7, 0xea, 0x14, 0xcf, 0xdc, 0xd7, 0xac, 0x19, 0x0d, 0xcc, 0xe9, 0x1f, 0xe4, 0x52, 0x9e, - 0x4f, 0x89, 0x42, 0xc2, 0x98, 0xc4, 0x5d, 0x3f, 0x11, 0xa3, 0xe1, 0x95, 0x02, 0x67, 0x19, 0x27, - 0xac, 0x93, 0x64, 0xf9, 0x7f, 0x6c, 0x30, 0x45, 0x1f, 0x86, 0x7a, 0x9c, 0x38, 0x51, 0x72, 0xc8, - 0xb4, 0x36, 0xd5, 0xe9, 0x2b, 0x92, 0x08, 0xd6, 0xf4, 0xd0, 0xab, 0xac, 0x50, 0xa2, 0x17, 0x6f, - 0x1c, 0x32, 0xd2, 0x59, 0x16, 0x55, 0x14, 0x14, 0xb0, 0x41, 0x8d, 0x6e, 0x3d, 0xd8, 0xd8, 0xe6, - 0xe1, 0x3d, 0x35, 0xb6, 0xb7, 0x54, 0xaa, 0x10, 0x2b, 0x08, 0x36, 0xb0, 0xec, 0x1f, 0x81, 0x74, - 0x96, 0x37, 0x9a, 0x90, 0x49, 0xe5, 0xdc, 0xf7, 0xc4, 0x22, 0x96, 0x53, 0xf9, 0xdf, 0xbf, 0x69, - 0x81, 0x99, 0x8a, 0x8e, 0xde, 0xe0, 0x39, 0xef, 0x56, 0x11, 0xe7, 0x05, 0x06, 0xdd, 0xc9, 0x45, - 0xa7, 0x93, 0x39, 0xb8, 0x92, 0x89, 0xef, 0xe7, 0xdf, 0x07, 0x35, 0x09, 0x3d, 0x90, 0x51, 0xf7, - 0x09, 0x38, 0x93, 0xbd, 0xac, 0x55, 0xf8, 0x9a, 0x5b, 0x51, 0xd8, 0xed, 0x64, 0x37, 0x92, 0xec, - 0x32, 0x4f, 0xcc, 0x61, 0x74, 0x3b, 0xb6, 0xe9, 0x05, 0xcd, 0xec, 0x46, 0xf2, 0x9a, 0x17, 0x34, - 0x31, 0x83, 0x0c, 0x70, 0x29, 0xdd, 0x6f, 0x59, 0x70, 0x61, 0xbf, 0x3b, 0x65, 0xd1, 0xe3, 0x50, - 0xb9, 0xe3, 0x44, 0xb2, 0x82, 0x2d, 0x53, 0x94, 0xb7, 0x9c, 0x28, 0xc0, 0xac, 0x15, 0xed, 0xc0, - 0x10, 0x8f, 0x01, 0x11, 0xd6, 0xfa, 0x2b, 0xc5, 0xde, 0x70, 0x7b, 0x8d, 0x18, 0xdb, 0x05, 0x1e, - 0x7f, 0x82, 0x05, 0x43, 0xfb, 0xbb, 0x16, 0xa0, 0xa5, 0x2d, 0x12, 0x45, 0x5e, 0xd3, 0x88, 0x5a, - 0x41, 0x2f, 0xc0, 0xe8, 0xed, 0x95, 0xa5, 0xeb, 0xcb, 0xa1, 0x17, 0xb0, 0xaa, 0x0f, 0x46, 0x62, - 0xdb, 0x55, 0xa3, 0x1d, 0xa7, 0xb0, 0xd0, 0x0c, 0x8c, 0xdd, 0x7e, 0x83, 0x6e, 0x7e, 0xcd, 0x6a, - 0xf9, 0x25, 0xed, 0xee, 0xbc, 0xfa, 0x4a, 0x06, 0x88, 0x7b, 0xf1, 0xd1, 0x12, 0x9c, 0x6b, 0xf3, - 0xed, 0x06, 0x2f, 0x72, 0xcd, 0xf7, 0x1e, 0x2a, 0x8d, 0xe4, 0xb1, 0xbd, 0xdd, 0x89, 0x73, 0x8b, - 0x79, 0x08, 0x38, 0xff, 0x39, 0xfb, 0x7d, 0x80, 0x78, 0xb0, 0xca, 0x4c, 0x5e, 0xe4, 0x41, 0xdf, - 0x9d, 0xb8, 0xfd, 0xb5, 0x2a, 0x9c, 0xca, 0xd4, 0x37, 0xa4, 0x5b, 0xbd, 0xde, 0x50, 0x87, 0x23, - 0xaf, 0xdf, 0xbd, 0xe2, 0x0d, 0x14, 0x3c, 0x11, 0x40, 0xd5, 0x0b, 0x3a, 0xdd, 0xa4, 0x98, 0xcc, - 0x31, 0x2e, 0xc4, 0x3c, 0x25, 0x68, 0x38, 0x89, 0xe8, 0x5f, 0xcc, 0xd9, 0x14, 0x19, 0x8a, 0x91, - 0x32, 0xc6, 0x2b, 0x0f, 0xc8, 0x1d, 0xf0, 0x29, 0x1d, 0x18, 0x51, 0x2d, 0xe2, 0xa0, 0x3e, 0x33, - 0x58, 0x8e, 0xfb, 0x80, 0xed, 0x37, 0x4a, 0x30, 0x62, 0x7c, 0x34, 0xf4, 0x2b, 0xe9, 0x42, 0x2d, - 0x56, 0x71, 0xaf, 0xc4, 0xe8, 0x4f, 0xea, 0x52, 0x2c, 0xfc, 0x95, 0x9e, 0xee, 0xad, 0xd1, 0x72, - 0x77, 0x77, 0xe2, 0x74, 0xa6, 0x0a, 0x4b, 0xaa, 0x6e, 0xcb, 0xf9, 0x8f, 0xc3, 0xa9, 0x0c, 0x99, - 0x9c, 0x57, 0x5e, 0x4d, 0xdf, 0xc5, 0x7b, 0x44, 0xb7, 0x94, 0xd9, 0x65, 0x6f, 0xd1, 0x2e, 0xd3, - 0x57, 0xb4, 0x0f, 0xe0, 0x8e, 0xcb, 0xe4, 0xc8, 0x95, 0x06, 0xcc, 0x91, 0x7b, 0x06, 0x6a, 0x9d, - 0xd0, 0xf7, 0x5c, 0x4f, 0x95, 0xf4, 0x62, 0x59, 0x79, 0xcb, 0xa2, 0x0d, 0x2b, 0x28, 0xba, 0x03, - 0x75, 0x75, 0x6d, 0xb1, 0x08, 0x42, 0x2c, 0xca, 0xd5, 0xab, 0x8c, 0x16, 0x7d, 0x1d, 0xb1, 0xe6, - 0x85, 0x6c, 0x18, 0x62, 0x8b, 0xa0, 0x0c, 0xf8, 0x65, 0x19, 0x9c, 0x6c, 0x75, 0x8c, 0xb1, 0x80, - 0xd8, 0xdf, 0xa8, 0xc3, 0xd9, 0xbc, 0x22, 0xb3, 0xe8, 0x63, 0x30, 0xc4, 0x65, 0x2c, 0xa6, 0x8e, - 0x79, 0x1e, 0x8f, 0x39, 0x46, 0x50, 0x88, 0xc5, 0x7e, 0x63, 0xc1, 0x53, 0x70, 0xf7, 0x9d, 0x35, - 0x31, 0x42, 0x8e, 0x87, 0xfb, 0x82, 0xa3, 0xb9, 0x2f, 0x38, 0x9c, 0xbb, 0xef, 0xac, 0xa1, 0x6d, - 0xa8, 0xb6, 0xbc, 0x84, 0x38, 0xc2, 0x89, 0x70, 0xeb, 0x58, 0x98, 0x13, 0x87, 0x5b, 0x69, 0xec, - 0x27, 0xe6, 0x0c, 0xd1, 0xd7, 0x2d, 0x38, 0xb5, 0x96, 0x4e, 0x88, 0x15, 0xca, 0xd3, 0x39, 0x86, - 0x42, 0xc2, 0x69, 0x46, 0xfc, 0x46, 0x8a, 0x4c, 0x23, 0xce, 0x8a, 0x83, 0x3e, 0x6d, 0xc1, 0xf0, - 0xba, 0xe7, 0x1b, 0x35, 0x25, 0x8f, 0xe1, 0xe3, 0x5c, 0x66, 0x0c, 0xf4, 0x8e, 0x83, 0xff, 0x8f, - 0xb1, 0xe4, 0xdc, 0x6f, 0xa5, 0x1a, 0x3a, 0xea, 0x4a, 0x35, 0xfc, 0x80, 0x56, 0xaa, 0xcf, 0x58, - 0x50, 0x57, 0x3d, 0x2d, 0x92, 0x1c, 0x3f, 0x7c, 0x8c, 0x9f, 0x9c, 0x7b, 0x4e, 0xd4, 0x5f, 0xac, - 0x99, 0xa3, 0x2f, 0x59, 0x30, 0xe2, 0xbc, 0xd9, 0x8d, 0x48, 0x93, 0x6c, 0x85, 0x9d, 0x58, 0xdc, - 0x02, 0xf5, 0x5a, 0xf1, 0xc2, 0x4c, 0x53, 0x26, 0xb3, 0x64, 0x6b, 0xa9, 0x13, 0x8b, 0x64, 0x04, - 0xdd, 0x80, 0x4d, 0x11, 0xec, 0xdd, 0x12, 0x4c, 0xec, 0x43, 0x01, 0xbd, 0x04, 0xa3, 0x61, 0xd4, - 0x72, 0x02, 0xef, 0x4d, 0x33, 0xc3, 0x5d, 0x59, 0x59, 0x4b, 0x06, 0x0c, 0xa7, 0x30, 0xcd, 0x34, - 0xcc, 0xd2, 0x3e, 0x69, 0x98, 0x17, 0xa0, 0x12, 0x91, 0x4e, 0x98, 0xdd, 0x2c, 0xb0, 0x40, 0x60, - 0x06, 0x41, 0x4f, 0x40, 0xd9, 0xe9, 0x78, 0x22, 0xfc, 0x44, 0xed, 0x81, 0xa6, 0x97, 0xe7, 0x31, - 0x6d, 0x4f, 0x65, 0x85, 0x57, 0xef, 0x4b, 0x56, 0x38, 0x5d, 0x06, 0xc4, 0xd9, 0xc5, 0x90, 0x5e, - 0x06, 0xd2, 0x67, 0x0a, 0xf6, 0x57, 0xcb, 0xf0, 0xc4, 0x3d, 0xc7, 0x8b, 0x8e, 0xbe, 0xb1, 0xee, - 0x11, 0x7d, 0x23, 0xbb, 0xa7, 0xb4, 0x5f, 0xf7, 0x94, 0xfb, 0x74, 0xcf, 0xa7, 0xe9, 0x34, 0x90, - 0x95, 0x01, 0x8a, 0xb9, 0x90, 0xa8, 0x5f, 0xa1, 0x01, 0x31, 0x03, 0x24, 0x14, 0x6b, 0xbe, 0x74, - 0x0f, 0x90, 0x4a, 0x41, 0xac, 0x16, 0xb1, 0x0c, 0xf4, 0xad, 0x14, 0xc0, 0xc7, 0x7e, 0xbf, 0xbc, - 0x46, 0xfb, 0x17, 0x4b, 0xf0, 0xd4, 0x00, 0xda, 0xdb, 0x1c, 0xc5, 0xd6, 0x80, 0xa3, 0xf8, 0xfb, - 0xfb, 0x33, 0xd9, 0x7f, 0xc9, 0x82, 0xf3, 0xfd, 0x17, 0x0f, 0xf4, 0x3c, 0x8c, 0xac, 0x45, 0x4e, - 0xe0, 0x6e, 0xb0, 0x4b, 0xd6, 0x64, 0xa7, 0xb0, 0xbe, 0xd6, 0xcd, 0xd8, 0xc4, 0xa1, 0xdb, 0x5b, - 0x5e, 0xd8, 0xdd, 0xc0, 0x90, 0x29, 0x63, 0x74, 0x7b, 0xbb, 0x9a, 0x05, 0xe2, 0x5e, 0x7c, 0xfb, - 0xf7, 0x4a, 0xf9, 0x62, 0x71, 0x23, 0xe3, 0x20, 0xdf, 0x49, 0x7c, 0x85, 0xd2, 0x00, 0xba, 0xa4, - 0x7c, 0xbf, 0x75, 0x49, 0xa5, 0x9f, 0x2e, 0x41, 0xb3, 0x70, 0xda, 0xb8, 0x8f, 0x80, 0xa7, 0x01, - 0xf2, 0x30, 0x3b, 0x95, 0x1b, 0xbf, 0x9c, 0x81, 0xe3, 0x9e, 0x27, 0xec, 0x5f, 0x2d, 0xc1, 0x63, - 0x7d, 0x2d, 0xa7, 0xfb, 0xa4, 0x8d, 0xcc, 0x0e, 0xae, 0xdc, 0x9f, 0x0e, 0x7e, 0x16, 0x6a, 0x5e, - 0x10, 0x13, 0xb7, 0x1b, 0xf1, 0x4e, 0x33, 0x32, 0x4e, 0xe6, 0x45, 0x3b, 0x56, 0x18, 0xf6, 0x1f, - 0xf4, 0x1f, 0x6a, 0xd4, 0x8a, 0xfe, 0x81, 0xed, 0xa5, 0x97, 0xe1, 0x84, 0xd3, 0xe9, 0x70, 0x3c, - 0x16, 0x77, 0x95, 0xa9, 0x76, 0x31, 0x6d, 0x02, 0x71, 0x1a, 0x77, 0xa0, 0xf5, 0xf0, 0x8f, 0x2d, - 0xa8, 0x63, 0xb2, 0xce, 0xe7, 0x3b, 0xba, 0x2d, 0xba, 0xc8, 0x2a, 0xa2, 0x2e, 0x1e, 0xed, 0xd8, - 0xd8, 0x63, 0xf5, 0xe2, 0xf2, 0x3a, 0xbb, 0xf7, 0x26, 0x8a, 0xd2, 0x81, 0x6e, 0xa2, 0x50, 0x77, - 0x11, 0x94, 0xfb, 0xdf, 0x45, 0x60, 0xbf, 0x35, 0x4c, 0x5f, 0xaf, 0x13, 0xce, 0x44, 0xa4, 0x19, - 0xd3, 0xef, 0xdb, 0x8d, 0x7c, 0x31, 0x48, 0xd4, 0xf7, 0xbd, 0x81, 0x17, 0x30, 0x6d, 0x4f, 0x1d, - 0xae, 0x94, 0x0e, 0x94, 0xeb, 0x5f, 0xde, 0x37, 0xd7, 0xff, 0x65, 0x38, 0x11, 0xc7, 0x1b, 0xcb, - 0x91, 0xb7, 0xe5, 0x24, 0xe4, 0x1a, 0xd9, 0x11, 0x76, 0x93, 0xce, 0xcf, 0x5d, 0xb9, 0xa2, 0x81, - 0x38, 0x8d, 0x8b, 0xe6, 0x60, 0x4c, 0x67, 0xdc, 0x93, 0x28, 0x61, 0x51, 0xba, 0x7c, 0x24, 0xa8, - 0x64, 0x3c, 0x9d, 0xa3, 0x2f, 0x10, 0x70, 0xef, 0x33, 0x54, 0x63, 0xa5, 0x1a, 0xa9, 0x20, 0x43, - 0x69, 0x8d, 0x95, 0xa2, 0x43, 0x65, 0xe9, 0x79, 0x02, 0x2d, 0xc2, 0x19, 0x3e, 0x30, 0xa6, 0x3b, - 0x1d, 0xe3, 0x8d, 0x86, 0xd3, 0xf5, 0xc8, 0xe6, 0x7a, 0x51, 0x70, 0xde, 0x73, 0xe8, 0x45, 0x18, - 0x51, 0xcd, 0xf3, 0xb3, 0xe2, 0x5c, 0x40, 0xf9, 0x25, 0x14, 0x99, 0xf9, 0x26, 0x36, 0xf1, 0xd0, - 0x87, 0xe0, 0x51, 0xfd, 0x97, 0xa7, 0x72, 0xf0, 0xc3, 0xb2, 0x59, 0x51, 0xcc, 0x44, 0x55, 0xbe, - 0x9f, 0xcb, 0x45, 0x6b, 0xe2, 0x7e, 0xcf, 0xa3, 0x35, 0x38, 0xaf, 0x40, 0x97, 0x82, 0x84, 0xc5, - 0x65, 0xc7, 0xa4, 0xe1, 0xc4, 0xe4, 0x46, 0xe4, 0xb3, 0xf2, 0x27, 0x75, 0x7d, 0x29, 0xd9, 0x9c, - 0x97, 0x5c, 0xc9, 0xc3, 0xc4, 0x0b, 0xf8, 0x1e, 0x54, 0xd0, 0x14, 0xd4, 0x49, 0xe0, 0xac, 0xf9, - 0x64, 0x69, 0x66, 0x9e, 0x15, 0x45, 0x31, 0xce, 0xe6, 0x2e, 0x49, 0x00, 0xd6, 0x38, 0x2a, 0x52, - 0x6c, 0xb4, 0xef, 0x05, 0x79, 0xcb, 0x70, 0xb6, 0xe5, 0x76, 0xa8, 0x35, 0xe1, 0xb9, 0x64, 0xda, - 0x65, 0xd1, 0x52, 0xf4, 0xc3, 0xf0, 0x42, 0x71, 0x2a, 0x0c, 0x72, 0x6e, 0x66, 0xb9, 0x07, 0x07, - 0xe7, 0x3e, 0x49, 0xe7, 0x58, 0x27, 0x0a, 0xb7, 0x77, 0xc6, 0xcf, 0xa4, 0xe7, 0xd8, 0x32, 0x6d, - 0xc4, 0x1c, 0x86, 0xae, 0x02, 0x62, 0x31, 0xb5, 0x57, 0x92, 0xa4, 0xa3, 0xcc, 0x97, 0xf1, 0xb3, - 0xec, 0x95, 0xce, 0x8b, 0x27, 0xd0, 0xe5, 0x1e, 0x0c, 0x9c, 0xf3, 0x94, 0xfd, 0x47, 0x16, 0x9c, - 0x50, 0xf3, 0xf5, 0x3e, 0x44, 0x95, 0xfb, 0xe9, 0xa8, 0xf2, 0xb9, 0xa3, 0x6b, 0x3c, 0x26, 0x79, - 0x9f, 0xd0, 0xc4, 0x9f, 0x1b, 0x01, 0xd0, 0x5a, 0x51, 0x2d, 0x48, 0x56, 0xdf, 0x05, 0xe9, 0xa1, - 0xd5, 0x48, 0x79, 0x15, 0x10, 0xaa, 0x0f, 0xb6, 0x02, 0xc2, 0x0a, 0x9c, 0x93, 0xe6, 0x02, 0x3f, - 0xfd, 0xb9, 0x12, 0xc6, 0x4a, 0xc1, 0xd5, 0x1a, 0x4f, 0x08, 0x42, 0xe7, 0xe6, 0xf3, 0x90, 0x70, - 0xfe, 0xb3, 0x29, 0x2b, 0x65, 0x78, 0x3f, 0x2b, 0x45, 0xcf, 0xe9, 0x85, 0x75, 0x59, 0xe2, 0x3e, - 0x33, 0xa7, 0x17, 0x2e, 0xaf, 0x60, 0x8d, 0x93, 0xaf, 0xd8, 0xeb, 0x05, 0x29, 0x76, 0x38, 0xb0, - 0x62, 0x97, 0x2a, 0x66, 0xa4, 0xaf, 0x8a, 0x91, 0x5e, 0xe6, 0xd1, 0xbe, 0x5e, 0xe6, 0xf7, 0xc3, - 0x49, 0x2f, 0xd8, 0x20, 0x91, 0x97, 0x90, 0x26, 0x9b, 0x0b, 0x4c, 0xfd, 0xd4, 0xf4, 0xb2, 0x3e, - 0x9f, 0x82, 0xe2, 0x0c, 0x76, 0x5a, 0x2f, 0x9e, 0x1c, 0x40, 0x2f, 0xf6, 0x59, 0x8d, 0x4e, 0x15, - 0xb3, 0x1a, 0x9d, 0x3e, 0xfa, 0x6a, 0x34, 0x76, 0xac, 0xab, 0x11, 0x2a, 0x64, 0x35, 0x1a, 0x48, - 0xd1, 0x1b, 0x1b, 0xba, 0xb3, 0xfb, 0x6c, 0xe8, 0xfa, 0x2d, 0x45, 0xe7, 0x0e, 0xbd, 0x14, 0xe5, - 0xaf, 0x32, 0x8f, 0x1c, 0x6a, 0x95, 0xf9, 0x4c, 0x09, 0xce, 0x69, 0x3d, 0x4c, 0x47, 0xbf, 0xb7, - 0x4e, 0x35, 0x11, 0xbb, 0x25, 0x85, 0x9f, 0xc4, 0x18, 0x49, 0x0e, 0x3a, 0x5f, 0x42, 0x41, 0xb0, - 0x81, 0xc5, 0x72, 0x05, 0x48, 0xc4, 0xca, 0x61, 0x66, 0x95, 0xf4, 0x8c, 0x68, 0xc7, 0x0a, 0x83, - 0x8e, 0x2f, 0xfa, 0x5b, 0xe4, 0x5f, 0x65, 0x8b, 0x3e, 0xcd, 0x68, 0x10, 0x36, 0xf1, 0xd0, 0x33, - 0x9c, 0x09, 0x53, 0x10, 0x54, 0x51, 0x8f, 0x8a, 0x6b, 0x13, 0xa5, 0x4e, 0x50, 0x50, 0x29, 0x0e, - 0x4b, 0x0a, 0xa9, 0xf6, 0x8a, 0xc3, 0x82, 0x9a, 0x14, 0x86, 0xfd, 0xdf, 0x2d, 0x78, 0x2c, 0xb7, - 0x2b, 0xee, 0xc3, 0xe2, 0xbb, 0x9d, 0x5e, 0x7c, 0x57, 0x8a, 0xda, 0x6e, 0x18, 0x6f, 0xd1, 0x67, - 0x21, 0xfe, 0x37, 0x16, 0x9c, 0xd4, 0xf8, 0xf7, 0xe1, 0x55, 0xbd, 0xf4, 0xab, 0x16, 0xb7, 0xb3, - 0xaa, 0xf7, 0xbc, 0xdb, 0x1f, 0xb1, 0x77, 0xe3, 0xe1, 0x12, 0xd3, 0xae, 0x2c, 0x73, 0xb9, 0xcf, - 0xd9, 0xe0, 0x0e, 0x0c, 0xb1, 0xa3, 0xcd, 0xb8, 0x98, 0xb0, 0x8d, 0x34, 0x7f, 0x76, 0x4c, 0xaa, - 0x8f, 0x8d, 0xd9, 0xdf, 0x18, 0x0b, 0x86, 0xac, 0x58, 0xab, 0x17, 0x53, 0x6d, 0xde, 0x14, 0xe9, - 0x15, 0xba, 0x58, 0xab, 0x68, 0xc7, 0x0a, 0xc3, 0x6e, 0xc3, 0x78, 0x9a, 0xf8, 0x2c, 0x59, 0x67, - 0xa1, 0x80, 0x03, 0xbd, 0xe6, 0x14, 0xd4, 0x1d, 0xf6, 0xd4, 0x42, 0xd7, 0xc9, 0xde, 0xb4, 0x3b, - 0x2d, 0x01, 0x58, 0xe3, 0xd8, 0xbf, 0x6e, 0xc1, 0x99, 0x9c, 0x97, 0x29, 0x30, 0xad, 0x24, 0xd1, - 0x5a, 0x20, 0x6f, 0xc1, 0x7d, 0x37, 0x0c, 0x37, 0xc9, 0xba, 0x23, 0x83, 0xcd, 0x0c, 0x9d, 0x3b, - 0xcb, 0x9b, 0xb1, 0x84, 0xdb, 0xff, 0xc5, 0x82, 0x53, 0x69, 0x59, 0x63, 0xaa, 0x35, 0xf9, 0xcb, - 0xcc, 0x7a, 0xb1, 0x1b, 0x6e, 0x91, 0x68, 0x87, 0xbe, 0x39, 0x97, 0x5a, 0x69, 0xcd, 0xe9, 0x1e, - 0x0c, 0x9c, 0xf3, 0x14, 0x2b, 0x8f, 0xd8, 0x54, 0xbd, 0x2d, 0x47, 0xca, 0xcd, 0x22, 0x47, 0x8a, - 0xfe, 0x98, 0xe6, 0xc1, 0xb4, 0x62, 0x89, 0x4d, 0xfe, 0xf6, 0x77, 0x2b, 0xa0, 0xf2, 0xce, 0x58, - 0xa4, 0x4f, 0x41, 0x71, 0x52, 0xa9, 0xdb, 0x85, 0xca, 0x03, 0xdc, 0x2e, 0x24, 0x07, 0x43, 0xe5, - 0x5e, 0x47, 0xef, 0xdc, 0x7b, 0x61, 0x3a, 0x09, 0xd5, 0x1b, 0xae, 0x6a, 0x10, 0x36, 0xf1, 0xa8, - 0x24, 0xbe, 0xb7, 0x45, 0xf8, 0x43, 0x43, 0x69, 0x49, 0x16, 0x24, 0x00, 0x6b, 0x1c, 0x2a, 0x49, - 0xd3, 0x5b, 0x5f, 0x17, 0x5b, 0x71, 0x25, 0x09, 0xed, 0x1d, 0xcc, 0x20, 0xbc, 0xe2, 0x6d, 0xb8, - 0x29, 0xac, 0x53, 0xa3, 0xe2, 0x6d, 0xb8, 0x89, 0x19, 0x84, 0xda, 0x53, 0x41, 0x18, 0xb5, 0xd9, - 0x4d, 0xc8, 0x4d, 0xc5, 0x45, 0x58, 0xa5, 0xca, 0x9e, 0xba, 0xde, 0x8b, 0x82, 0xf3, 0x9e, 0xa3, - 0x23, 0xb0, 0x13, 0x91, 0xa6, 0xe7, 0x26, 0x26, 0x35, 0x48, 0x8f, 0xc0, 0xe5, 0x1e, 0x0c, 0x9c, - 0xf3, 0x14, 0x9a, 0x86, 0x53, 0x32, 0x6f, 0x50, 0x56, 0x85, 0x18, 0x49, 0x67, 0xa1, 0xe3, 0x34, - 0x18, 0x67, 0xf1, 0xa9, 0xb6, 0x69, 0x8b, 0x82, 0x30, 0xcc, 0x88, 0x35, 0xb4, 0x8d, 0x2c, 0x14, - 0x83, 0x15, 0x86, 0xfd, 0xa9, 0x32, 0x5d, 0x1d, 0xfb, 0x14, 0x42, 0xba, 0x6f, 0x71, 0x79, 0xe9, - 0x11, 0x59, 0x19, 0x60, 0x44, 0xbe, 0x00, 0xa3, 0xb7, 0xe3, 0x30, 0x50, 0x31, 0x6f, 0xd5, 0xbe, - 0x31, 0x6f, 0x06, 0x56, 0x7e, 0xcc, 0xdb, 0x50, 0x51, 0x31, 0x6f, 0xc3, 0x87, 0x8c, 0x79, 0xfb, - 0x56, 0x15, 0x54, 0xe9, 0xfd, 0xeb, 0x24, 0xb9, 0x13, 0x46, 0x9b, 0x5e, 0xd0, 0x62, 0xf9, 0x96, - 0x5f, 0xb7, 0x60, 0x94, 0xcf, 0x97, 0x05, 0x33, 0x67, 0x69, 0xbd, 0xa0, 0x9a, 0xee, 0x29, 0x66, - 0x93, 0xab, 0x06, 0xa3, 0xcc, 0x8d, 0x71, 0x26, 0x08, 0xa7, 0x24, 0x42, 0x1f, 0x07, 0x90, 0x7e, - 0xcb, 0x75, 0xa9, 0x32, 0xe7, 0x8b, 0x91, 0x0f, 0x93, 0x75, 0x6d, 0x9b, 0xae, 0x2a, 0x26, 0xd8, - 0x60, 0x88, 0x3e, 0x93, 0xbd, 0x29, 0xfe, 0xa3, 0xc7, 0xd2, 0x37, 0x83, 0x64, 0x73, 0x61, 0x18, - 0xf6, 0x82, 0x16, 0x1d, 0x27, 0x22, 0x36, 0xe8, 0x5d, 0x79, 0xb9, 0xca, 0x0b, 0xa1, 0xd3, 0x6c, - 0x38, 0xbe, 0x13, 0xb8, 0x24, 0x9a, 0xe7, 0xe8, 0xe6, 0x3d, 0xa9, 0xac, 0x01, 0x4b, 0x42, 0x3d, - 0x97, 0x16, 0x54, 0x07, 0xb9, 0xb4, 0xe0, 0xfc, 0x07, 0x60, 0xac, 0xe7, 0x63, 0x1e, 0x28, 0x79, - 0xeb, 0xf0, 0x79, 0x5f, 0xf6, 0x3f, 0x1d, 0xd2, 0x8b, 0xd6, 0xf5, 0xb0, 0xc9, 0x4b, 0xe7, 0x47, - 0xfa, 0x8b, 0x0a, 0xdb, 0xb3, 0xc0, 0x21, 0x62, 0xdc, 0xb5, 0xaa, 0x1a, 0xb1, 0xc9, 0x92, 0x8e, - 0xd1, 0x8e, 0x13, 0x91, 0xe0, 0xb8, 0xc7, 0xe8, 0xb2, 0x62, 0x82, 0x0d, 0x86, 0x68, 0x23, 0x95, - 0xbd, 0x71, 0xf9, 0xe8, 0xd9, 0x1b, 0xac, 0x8a, 0x4b, 0x5e, 0xb5, 0xeb, 0x2f, 0x59, 0x70, 0x32, - 0x48, 0x8d, 0xdc, 0x62, 0x02, 0x36, 0xf3, 0x67, 0x05, 0xbf, 0xb9, 0x25, 0xdd, 0x86, 0x33, 0xfc, - 0xf3, 0x96, 0xb4, 0xea, 0x01, 0x97, 0x34, 0x7d, 0x07, 0xc7, 0x50, 0xbf, 0x3b, 0x38, 0x50, 0xa0, - 0x2e, 0x21, 0x1a, 0x2e, 0xfc, 0x12, 0x22, 0xc8, 0xb9, 0x80, 0xe8, 0x16, 0xd4, 0xdd, 0x88, 0x38, - 0xc9, 0x21, 0xef, 0xa3, 0x61, 0x47, 0xe1, 0x33, 0x92, 0x00, 0xd6, 0xb4, 0xec, 0xff, 0x5d, 0x81, - 0xd3, 0xb2, 0x47, 0x64, 0xb0, 0x37, 0x5d, 0x1f, 0x39, 0x5f, 0x6d, 0xdc, 0xaa, 0xf5, 0xf1, 0x8a, - 0x04, 0x60, 0x8d, 0x43, 0xed, 0xb1, 0x6e, 0x4c, 0x96, 0x3a, 0x24, 0x58, 0xf0, 0xd6, 0x62, 0x71, - 0xfe, 0xa8, 0x26, 0xca, 0x0d, 0x0d, 0xc2, 0x26, 0x1e, 0x35, 0xc6, 0xb9, 0x5d, 0x1c, 0x67, 0x13, - 0x45, 0x84, 0xbd, 0x8d, 0x25, 0x1c, 0xfd, 0x52, 0x6e, 0x65, 0xc6, 0x62, 0x52, 0xa4, 0x7a, 0x62, - 0xdc, 0x0f, 0x78, 0x85, 0xd9, 0xdf, 0xb0, 0xe0, 0x1c, 0x6f, 0x95, 0x3d, 0x79, 0xa3, 0xd3, 0x74, - 0x12, 0x12, 0x17, 0x53, 0x29, 0x39, 0x47, 0x3e, 0xed, 0x7c, 0xcd, 0x63, 0x8b, 0xf3, 0xa5, 0x41, - 0x5f, 0xb4, 0xe0, 0xd4, 0x66, 0x2a, 0xa7, 0x5e, 0x2e, 0x1d, 0x47, 0xac, 0xfe, 0x92, 0x4e, 0xd4, - 0xd7, 0x53, 0x2d, 0xdd, 0x1e, 0xe3, 0x2c, 0x77, 0xfb, 0xbf, 0x5a, 0x60, 0xaa, 0xd1, 0xc1, 0x2c, - 0x40, 0xe3, 0xd2, 0xd8, 0xd2, 0x3e, 0x97, 0xc6, 0x4a, 0x63, 0xb1, 0x3c, 0xd8, 0xe6, 0xa4, 0x72, - 0x80, 0xcd, 0x49, 0xb5, 0xaf, 0x75, 0xf9, 0x04, 0x94, 0xbb, 0x5e, 0x53, 0xec, 0x2f, 0xf4, 0xa9, - 0xe8, 0xfc, 0x2c, 0xa6, 0xed, 0xf6, 0x3f, 0xaa, 0x6a, 0x7f, 0x82, 0xc8, 0x40, 0xfa, 0x81, 0x78, - 0xed, 0x75, 0x55, 0xcc, 0x87, 0xbf, 0xf9, 0xf5, 0x9e, 0x62, 0x3e, 0x3f, 0x76, 0xf0, 0x04, 0x33, - 0xde, 0x41, 0xfd, 0x6a, 0xf9, 0x0c, 0xef, 0x93, 0x5d, 0x76, 0x1b, 0x6a, 0x74, 0x0b, 0xc6, 0x1c, - 0x83, 0xb5, 0x94, 0x50, 0xb5, 0x2b, 0xa2, 0xfd, 0xee, 0xee, 0xc4, 0x8f, 0x1e, 0x5c, 0x2c, 0xf9, - 0x34, 0x56, 0xf4, 0x51, 0x0c, 0x75, 0xfa, 0x9b, 0x25, 0xc2, 0x89, 0xcd, 0xdd, 0x0d, 0xa5, 0x33, - 0x25, 0xa0, 0x90, 0x2c, 0x3b, 0xcd, 0x07, 0x05, 0x50, 0x67, 0xb7, 0x3d, 0x32, 0xa6, 0x7c, 0x0f, - 0xb8, 0xac, 0xd2, 0xd1, 0x24, 0xe0, 0xee, 0xee, 0xc4, 0xcb, 0x07, 0x67, 0xaa, 0x1e, 0xc7, 0x9a, - 0x85, 0xfd, 0xe5, 0x8a, 0x1e, 0xbb, 0xa2, 0x86, 0xd3, 0x0f, 0xc4, 0xd8, 0x7d, 0x29, 0x33, 0x76, - 0x2f, 0xf4, 0x8c, 0xdd, 0x93, 0xfa, 0x56, 0xc2, 0xd4, 0x68, 0xbc, 0xdf, 0x86, 0xc0, 0xfe, 0xfe, - 0x06, 0x66, 0x01, 0xbd, 0xd1, 0xf5, 0x22, 0x12, 0x2f, 0x47, 0xdd, 0xc0, 0x0b, 0x5a, 0xe2, 0xb6, - 0x79, 0xc3, 0x02, 0x4a, 0x81, 0x71, 0x16, 0x9f, 0xdd, 0x54, 0xbf, 0x13, 0xb8, 0xb7, 0x9c, 0x2d, - 0x3e, 0xaa, 0x8c, 0xb2, 0x36, 0x2b, 0xa2, 0x1d, 0x2b, 0x0c, 0xfb, 0x2d, 0x76, 0xc6, 0x6c, 0x64, - 0xe0, 0xd2, 0x31, 0xe1, 0xb3, 0xeb, 0x35, 0x79, 0x4d, 0x1c, 0x35, 0x26, 0xf8, 0x9d, 0x9a, 0x1c, - 0x86, 0xee, 0xc0, 0xf0, 0x1a, 0xbf, 0x5f, 0xaa, 0x98, 0xfa, 0xbf, 0xe2, 0xb2, 0x2a, 0x76, 0x8b, - 0x80, 0xbc, 0xb9, 0xea, 0xae, 0xfe, 0x89, 0x25, 0x37, 0xfb, 0x9b, 0x15, 0x38, 0x95, 0xb9, 0x80, - 0x31, 0x55, 0x8d, 0xb0, 0xb4, 0x6f, 0x35, 0xc2, 0x8f, 0x00, 0x34, 0x49, 0xc7, 0x0f, 0x77, 0x98, - 0x39, 0x56, 0x39, 0xb0, 0x39, 0xa6, 0x2c, 0xf8, 0x59, 0x45, 0x05, 0x1b, 0x14, 0x45, 0x21, 0x20, - 0x5e, 0xdc, 0x30, 0x53, 0x08, 0xc8, 0xa8, 0x12, 0x3e, 0x74, 0x7f, 0xab, 0x84, 0x7b, 0x70, 0x8a, - 0x8b, 0xa8, 0xf2, 0x5c, 0x0f, 0x91, 0xce, 0xca, 0x32, 0x05, 0x66, 0xd3, 0x64, 0x70, 0x96, 0xee, - 0x83, 0xbc, 0x5f, 0x15, 0xbd, 0x07, 0xea, 0xf2, 0x3b, 0xc7, 0xe3, 0x75, 0x5d, 0x2b, 0x40, 0x0e, - 0x03, 0x76, 0xef, 0xa9, 0xf8, 0x69, 0x7f, 0xa1, 0x44, 0xad, 0x67, 0xfe, 0x4f, 0xd5, 0x7c, 0x79, - 0x1a, 0x86, 0x9c, 0x6e, 0xb2, 0x11, 0xf6, 0xdc, 0x51, 0x35, 0xcd, 0x5a, 0xb1, 0x80, 0xa2, 0x05, - 0xa8, 0x34, 0x75, 0x1d, 0x8f, 0x83, 0xf4, 0xa2, 0x76, 0x44, 0x3a, 0x09, 0xc1, 0x8c, 0x0a, 0x7a, - 0x1c, 0x2a, 0x89, 0xd3, 0x92, 0x29, 0x45, 0x2c, 0x8d, 0x74, 0xd5, 0x69, 0xc5, 0x98, 0xb5, 0x9a, - 0x8b, 0x66, 0x65, 0x9f, 0x45, 0xf3, 0x65, 0x38, 0x11, 0x7b, 0xad, 0xc0, 0x49, 0xba, 0x11, 0x31, - 0x0e, 0xbd, 0x74, 0x1c, 0x83, 0x09, 0xc4, 0x69, 0x5c, 0xfb, 0xb7, 0x47, 0xe1, 0xec, 0xca, 0xcc, - 0xa2, 0xac, 0x49, 0x7b, 0x6c, 0x59, 0x41, 0x79, 0x3c, 0xee, 0x5f, 0x56, 0x50, 0x1f, 0xee, 0xbe, - 0x91, 0x15, 0xe4, 0x1b, 0x59, 0x41, 0xe9, 0x14, 0x8d, 0x72, 0x11, 0x29, 0x1a, 0x79, 0x12, 0x0c, - 0x92, 0xa2, 0x71, 0x6c, 0x69, 0x42, 0xf7, 0x14, 0xe8, 0x40, 0x69, 0x42, 0x2a, 0x87, 0xaa, 0x90, - 0xe0, 0xf9, 0x3e, 0x9f, 0x2a, 0x37, 0x87, 0x4a, 0xe5, 0xaf, 0xf0, 0xc4, 0x10, 0xa1, 0x60, 0x5f, - 0x2b, 0x5e, 0x80, 0x01, 0xf2, 0x57, 0x44, 0x6e, 0x8a, 0x99, 0x33, 0x35, 0x5c, 0x44, 0xce, 0x54, - 0x9e, 0x38, 0xfb, 0xe6, 0x4c, 0xbd, 0x0c, 0x27, 0x5c, 0x3f, 0x0c, 0xc8, 0x72, 0x14, 0x26, 0xa1, - 0x1b, 0xfa, 0xc2, 0x98, 0x56, 0x2a, 0x61, 0xc6, 0x04, 0xe2, 0x34, 0x6e, 0xbf, 0x84, 0xab, 0xfa, - 0x51, 0x13, 0xae, 0xe0, 0x01, 0x25, 0x5c, 0xfd, 0xbc, 0x4e, 0x0d, 0x1e, 0x61, 0x5f, 0xe4, 0x23, - 0xc5, 0x7f, 0x91, 0x41, 0xf2, 0x83, 0xd1, 0x57, 0xf9, 0x25, 0x51, 0xd4, 0x1c, 0x9d, 0x09, 0xdb, - 0xd4, 0xdc, 0x1a, 0x65, 0x5d, 0xf2, 0xfa, 0x31, 0x0c, 0xd8, 0x5b, 0x2b, 0x9a, 0x8d, 0xba, 0x38, - 0x4a, 0x37, 0xe1, 0xb4, 0x20, 0x47, 0x49, 0x5d, 0xfe, 0x5a, 0x09, 0x7e, 0x68, 0x5f, 0x11, 0xd0, - 0x1d, 0x80, 0xc4, 0x69, 0x89, 0x81, 0x2a, 0x8e, 0x29, 0x8e, 0x18, 0x6c, 0xb8, 0x2a, 0xe9, 0xf1, - 0x9a, 0x1b, 0xea, 0x2f, 0x3b, 0x00, 0x90, 0xbf, 0x59, 0x8c, 0x61, 0xe8, 0xf7, 0xd4, 0x17, 0xc4, - 0xa1, 0x4f, 0x30, 0x83, 0xd0, 0xe5, 0x3f, 0x22, 0x2d, 0x7d, 0xab, 0xa9, 0xfa, 0x7c, 0x98, 0xb5, - 0x62, 0x01, 0x45, 0x2f, 0xc2, 0x88, 0xe3, 0xfb, 0x3c, 0xff, 0x83, 0x5d, 0x32, 0x92, 0xf2, 0x99, - 0x4d, 0x6b, 0x10, 0x36, 0xf1, 0xec, 0x3f, 0x2d, 0xc1, 0xc4, 0x3e, 0x3a, 0xa5, 0x27, 0xa3, 0xad, - 0x3a, 0x70, 0x46, 0x9b, 0x88, 0xd8, 0x1f, 0xea, 0x13, 0xb1, 0xff, 0x22, 0x8c, 0x24, 0xc4, 0x69, - 0x8b, 0xf0, 0x24, 0xb1, 0xff, 0xd6, 0xe7, 0xae, 0x1a, 0x84, 0x4d, 0x3c, 0xaa, 0xc5, 0x4e, 0x3a, - 0xae, 0x4b, 0xe2, 0x58, 0x86, 0xe4, 0x0b, 0x1f, 0x66, 0x61, 0xf1, 0xfe, 0xcc, 0x35, 0x3c, 0x9d, - 0x62, 0x81, 0x33, 0x2c, 0xb3, 0x1d, 0x5e, 0x1f, 0xb0, 0xc3, 0xbf, 0x51, 0x82, 0x27, 0xee, 0xb9, - 0xba, 0x0d, 0x9c, 0x2d, 0xd1, 0x8d, 0x49, 0x94, 0x1d, 0x38, 0x37, 0x62, 0x12, 0x61, 0x06, 0xe1, - 0xbd, 0xd4, 0xe9, 0x18, 0xb7, 0xc6, 0x16, 0x9d, 0x9c, 0xc3, 0x7b, 0x29, 0xc5, 0x02, 0x67, 0x58, - 0x1e, 0x76, 0x58, 0xfe, 0x9d, 0x12, 0x3c, 0x35, 0x80, 0x0d, 0x50, 0x60, 0x12, 0x53, 0x3a, 0x95, - 0xac, 0xfc, 0x80, 0x32, 0xfe, 0x0e, 0xd9, 0x5d, 0x6f, 0x95, 0xe0, 0x7c, 0xff, 0xa5, 0x18, 0xfd, - 0x38, 0xdd, 0xc3, 0xcb, 0x98, 0x24, 0x33, 0x0b, 0xed, 0x0c, 0xdf, 0xbf, 0xa7, 0x40, 0x38, 0x8b, - 0x8b, 0x26, 0x01, 0x3a, 0x4e, 0xb2, 0x11, 0x5f, 0xda, 0xf6, 0xe2, 0x44, 0x54, 0x59, 0x39, 0xc9, - 0x4f, 0x8c, 0x64, 0x2b, 0x36, 0x30, 0x28, 0x3b, 0xf6, 0x6f, 0x36, 0xbc, 0x1e, 0x26, 0xfc, 0x21, - 0xbe, 0x8d, 0x38, 0x23, 0x2b, 0xd1, 0x1b, 0x20, 0x9c, 0xc5, 0xa5, 0xec, 0xd8, 0x99, 0x24, 0x17, - 0x94, 0xef, 0x2f, 0x18, 0xbb, 0x05, 0xd5, 0x8a, 0x0d, 0x8c, 0x6c, 0x7e, 0x5d, 0x75, 0xff, 0xfc, - 0x3a, 0xfb, 0x1f, 0x96, 0xe0, 0xb1, 0xbe, 0xa6, 0xdc, 0x60, 0x13, 0xf0, 0xe1, 0xcb, 0x89, 0x3b, - 0xdc, 0xd8, 0x39, 0x60, 0xa6, 0xd7, 0x1f, 0xf7, 0x19, 0x69, 0x22, 0xd3, 0xeb, 0xf0, 0xc9, 0xcf, - 0x0f, 0x5f, 0x7f, 0xf6, 0x24, 0x77, 0x55, 0x0e, 0x90, 0xdc, 0x95, 0xf9, 0x18, 0xd5, 0x01, 0x27, - 0xf2, 0xb7, 0xfb, 0x77, 0x2f, 0xdd, 0xfa, 0x0d, 0xe4, 0x1d, 0x9d, 0x85, 0xd3, 0x5e, 0xc0, 0x6e, - 0x25, 0x59, 0xe9, 0xae, 0x89, 0xc2, 0x1b, 0xa5, 0xf4, 0x9d, 0xc0, 0xf3, 0x19, 0x38, 0xee, 0x79, - 0xe2, 0x21, 0x4c, 0xb6, 0x3b, 0x64, 0x97, 0x7e, 0x04, 0xea, 0x8a, 0x36, 0x0f, 0x20, 0x56, 0x1f, - 0xb4, 0x27, 0x80, 0x58, 0x7d, 0x4d, 0x03, 0x8b, 0xf6, 0x04, 0x35, 0x37, 0x33, 0x23, 0xf3, 0x1a, - 0xd9, 0x61, 0xb6, 0xa7, 0xfd, 0x5e, 0x18, 0x55, 0x3e, 0x8c, 0x41, 0xaf, 0x9e, 0xb0, 0xbf, 0x3c, - 0x04, 0x27, 0x52, 0x85, 0xe5, 0x52, 0x2e, 0x43, 0x6b, 0x5f, 0x97, 0x21, 0x0b, 0x08, 0xef, 0x06, - 0xf2, 0x5e, 0x1a, 0x23, 0x20, 0xbc, 0x1b, 0x10, 0xcc, 0x61, 0xd4, 0x74, 0x6c, 0x46, 0x3b, 0xb8, - 0x1b, 0x88, 0xc0, 0x4d, 0x65, 0x3a, 0xce, 0xb2, 0x56, 0x2c, 0xa0, 0xe8, 0x93, 0x16, 0x8c, 0xc6, - 0xcc, 0x1f, 0xcd, 0x1d, 0xae, 0xe2, 0x83, 0x5e, 0x3d, 0x7a, 0xdd, 0x3c, 0x55, 0x44, 0x91, 0xc5, - 0x7c, 0x98, 0x2d, 0x38, 0xc5, 0x11, 0xfd, 0xac, 0x05, 0x75, 0x55, 0x3e, 0x5f, 0x5c, 0x1e, 0xb5, - 0x52, 0x6c, 0xdd, 0x3e, 0xee, 0xa9, 0x53, 0xae, 0x7d, 0x7d, 0x1f, 0xb6, 0x66, 0x8c, 0x62, 0xe5, - 0x0d, 0x1d, 0x3e, 0x1e, 0x6f, 0x28, 0xe4, 0x78, 0x42, 0xdf, 0x03, 0xf5, 0xb6, 0x13, 0x78, 0xeb, - 0x24, 0x4e, 0xb8, 0x83, 0x52, 0x96, 0x13, 0x95, 0x8d, 0x58, 0xc3, 0xe9, 0x62, 0x17, 0xb3, 0x17, - 0x4b, 0x0c, 0x8f, 0x22, 0x5b, 0xec, 0x56, 0x74, 0x33, 0x36, 0x71, 0x4c, 0xf7, 0x27, 0x3c, 0x50, - 0xf7, 0xe7, 0xc8, 0x3e, 0xee, 0xcf, 0xbf, 0x67, 0xc1, 0xb9, 0xdc, 0xaf, 0xf6, 0xf0, 0x86, 0xf2, - 0xd9, 0x5f, 0xa9, 0xc2, 0x99, 0x9c, 0x0a, 0x91, 0x68, 0xc7, 0x1c, 0xcf, 0x56, 0x11, 0xa7, 0xe2, - 0xe9, 0x43, 0x5e, 0xd9, 0x8d, 0x39, 0x83, 0xf8, 0x60, 0x87, 0x0f, 0xfa, 0x00, 0xa0, 0x7c, 0x7f, - 0x0f, 0x00, 0x8c, 0x61, 0x59, 0x79, 0xa0, 0xc3, 0xb2, 0x7a, 0xef, 0x61, 0x89, 0x7e, 0xc3, 0x82, - 0xf1, 0x76, 0x9f, 0xb2, 0xe4, 0xc2, 0xa9, 0x77, 0xf3, 0x78, 0x8a, 0x9e, 0x37, 0x1e, 0xdf, 0xdb, - 0x9d, 0xe8, 0x5b, 0x0d, 0x1e, 0xf7, 0x95, 0xca, 0xfe, 0x6e, 0x19, 0x58, 0x79, 0x52, 0x56, 0x05, - 0x6c, 0x07, 0x7d, 0xc2, 0x2c, 0x34, 0x6b, 0x15, 0x55, 0x14, 0x95, 0x13, 0x57, 0x85, 0x6a, 0x79, - 0x0f, 0xe6, 0xd5, 0xad, 0xcd, 0x2a, 0xad, 0xd2, 0x00, 0x4a, 0xcb, 0x97, 0x15, 0x7d, 0xcb, 0xc5, - 0x57, 0xf4, 0xad, 0x67, 0xab, 0xf9, 0xde, 0xfb, 0x13, 0x57, 0x1e, 0xca, 0x4f, 0xfc, 0xd7, 0x2c, - 0xae, 0x78, 0x32, 0x5f, 0x41, 0x5b, 0x06, 0xd6, 0x3d, 0x2c, 0x83, 0x67, 0xd9, 0xcd, 0xe6, 0xeb, - 0x57, 0x88, 0xe3, 0x0b, 0x0b, 0xc2, 0xbc, 0xa4, 0x9c, 0xb5, 0x63, 0x85, 0xc1, 0x2e, 0xfa, 0xf3, - 0xfd, 0xf0, 0xce, 0xa5, 0x76, 0x27, 0xd9, 0x11, 0xb6, 0x84, 0xbe, 0xe8, 0x4f, 0x41, 0xb0, 0x81, - 0x65, 0xff, 0xf5, 0x12, 0x1f, 0x81, 0xe2, 0x58, 0xff, 0xa5, 0xcc, 0xd5, 0x4c, 0x83, 0x9f, 0x88, - 0x7f, 0x0c, 0xc0, 0x55, 0x97, 0x1a, 0x8b, 0xf3, 0x96, 0x2b, 0x47, 0xbe, 0x71, 0x55, 0xd0, 0xd3, - 0xaf, 0xa1, 0xdb, 0xb0, 0xc1, 0x2f, 0xa5, 0x4b, 0xcb, 0xfb, 0xea, 0xd2, 0x94, 0x5a, 0xa9, 0xec, - 0xb3, 0xda, 0xfd, 0xa9, 0x05, 0x29, 0x8b, 0x08, 0x75, 0xa0, 0x4a, 0xc5, 0xdd, 0x29, 0xe6, 0xbe, - 0x66, 0x93, 0x34, 0x55, 0x8d, 0x62, 0xd8, 0xb3, 0x9f, 0x98, 0x33, 0x42, 0xbe, 0x38, 0xfd, 0x2f, - 0x15, 0x71, 0xa7, 0xb8, 0xc9, 0xf0, 0x4a, 0x18, 0x6e, 0xf2, 0x43, 0x43, 0x1d, 0x49, 0x60, 0xbf, - 0x04, 0x63, 0x3d, 0x42, 0xb1, 0x5b, 0x58, 0x42, 0x79, 0x49, 0xb5, 0x31, 0x5c, 0x59, 0xaa, 0x20, - 0xe6, 0x30, 0xfb, 0x2d, 0x0b, 0x4e, 0x67, 0xc9, 0xa3, 0xaf, 0x5a, 0x30, 0x16, 0x67, 0xe9, 0x1d, - 0x57, 0xdf, 0xa9, 0x08, 0xbe, 0x1e, 0x10, 0xee, 0x15, 0xc2, 0xfe, 0x3f, 0x62, 0xf0, 0xdf, 0xf2, - 0x82, 0x66, 0x78, 0x47, 0x19, 0x26, 0x56, 0x5f, 0xc3, 0x84, 0xce, 0x47, 0x77, 0x83, 0x34, 0xbb, - 0x7e, 0x4f, 0x8e, 0xe2, 0x8a, 0x68, 0xc7, 0x0a, 0x83, 0xa5, 0x64, 0x75, 0x45, 0xc9, 0xef, 0xcc, - 0xa0, 0x9c, 0x15, 0xed, 0x58, 0x61, 0xa0, 0x17, 0x60, 0xd4, 0xbc, 0x88, 0x5d, 0x8c, 0x4b, 0x66, - 0x90, 0x9b, 0x77, 0xb6, 0xe3, 0x14, 0x16, 0x9a, 0x04, 0x50, 0x46, 0x8e, 0x5c, 0x22, 0x99, 0x13, - 0x46, 0x69, 0xa2, 0x18, 0x1b, 0x18, 0x2c, 0x01, 0x92, 0xdf, 0x76, 0x2e, 0xe3, 0x5c, 0x79, 0x02, - 0xa4, 0x68, 0xc3, 0x0a, 0x4a, 0xb5, 0x49, 0xdb, 0x09, 0xba, 0x8e, 0x4f, 0x7b, 0x48, 0x64, 0x6d, - 0xab, 0x69, 0xb8, 0xa8, 0x20, 0xd8, 0xc0, 0xa2, 0x6f, 0x9c, 0x78, 0x6d, 0xf2, 0x6a, 0x18, 0xc8, - 0xc8, 0x2b, 0x7d, 0xa4, 0x22, 0xda, 0xb1, 0xc2, 0xb0, 0xff, 0x93, 0x05, 0xa7, 0x74, 0x3a, 0x35, - 0xbf, 0x6f, 0xd5, 0xf4, 0x72, 0x58, 0xfb, 0x66, 0x8a, 0xa7, 0xf3, 0x4c, 0x4b, 0x03, 0xe5, 0x99, - 0x9a, 0x29, 0xa0, 0xe5, 0x7b, 0xa6, 0x80, 0xfe, 0xb0, 0xbe, 0xcb, 0x8f, 0xe7, 0x8a, 0x8e, 0xe4, - 0xdd, 0xe3, 0x87, 0x6c, 0x18, 0x72, 0x1d, 0x55, 0x4b, 0x64, 0x94, 0xef, 0x1d, 0x66, 0xa6, 0x19, - 0x92, 0x80, 0xd8, 0x4b, 0x50, 0x57, 0x27, 0x0b, 0x72, 0xa3, 0x6a, 0xe5, 0x6f, 0x54, 0x07, 0x4a, - 0x79, 0x6b, 0xac, 0x7d, 0xf3, 0x7b, 0x4f, 0xbe, 0xe3, 0xdb, 0xdf, 0x7b, 0xf2, 0x1d, 0x7f, 0xf8, - 0xbd, 0x27, 0xdf, 0xf1, 0xc9, 0xbd, 0x27, 0xad, 0x6f, 0xee, 0x3d, 0x69, 0x7d, 0x7b, 0xef, 0x49, - 0xeb, 0x0f, 0xf7, 0x9e, 0xb4, 0xbe, 0xbb, 0xf7, 0xa4, 0xf5, 0xa5, 0x7f, 0xff, 0xe4, 0x3b, 0x5e, - 0xcd, 0x0d, 0xbd, 0xa3, 0x3f, 0x9e, 0x73, 0x9b, 0x53, 0x5b, 0x17, 0x59, 0xf4, 0x17, 0x9d, 0x5e, - 0x53, 0xc6, 0x98, 0x9a, 0x92, 0xd3, 0xeb, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0x92, 0xc7, 0x3a, - 0x54, 0xc0, 0xd8, 0x00, 0x00, + // 10576 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7d, 0x6d, 0x70, 0x25, 0xd9, + 0x75, 0x90, 0xfb, 0x7d, 0x48, 0xef, 0x1d, 0x69, 0x3e, 0x74, 0x67, 0x66, 0x57, 0x3b, 0xde, 0x5d, + 0x4d, 0x7a, 0x2b, 0xeb, 0x35, 0xde, 0x95, 0xb2, 0xe3, 0x5d, 0xb3, 0x64, 0x13, 0x3b, 0x7a, 0xd2, + 0x8c, 0x46, 0x33, 0xd2, 0x48, 0x7b, 0xa5, 0x99, 0xb1, 0xd7, 0x59, 0xaf, 0x5b, 0xfd, 0xae, 0x9e, + 0x7a, 0xd4, 0xaf, 0xfb, 0x6d, 0x77, 0x3f, 0x8d, 0xb4, 0xb1, 0x1d, 0x3b, 0xce, 0x87, 0xc1, 0x9f, + 0xd8, 0x50, 0x71, 0x00, 0x07, 0x27, 0x0e, 0x14, 0x29, 0xd8, 0x22, 0xc0, 0x0f, 0x02, 0x81, 0x4a, + 0x25, 0xf0, 0xc3, 0x94, 0xa1, 0x48, 0x51, 0xa9, 0x38, 0x90, 0x44, 0xd8, 0xa2, 0x28, 0x28, 0xaa, + 0x48, 0x55, 0x80, 0x1f, 0x30, 0x50, 0x40, 0xdd, 0xef, 0xdb, 0xfd, 0xfa, 0x8d, 0x9e, 0xa4, 0xd6, + 0xcc, 0xd8, 0xd9, 0x7f, 0xef, 0xdd, 0x73, 0xfa, 0x9c, 0xd3, 0xb7, 0xef, 0x3d, 0xf7, 0xdc, 0x73, + 0xcf, 0x39, 0x17, 0x16, 0x5a, 0x5e, 0xb2, 0xd1, 0x5d, 0x9b, 0x74, 0xc3, 0xf6, 0x94, 0x13, 0xb5, + 0xc2, 0x4e, 0x14, 0xde, 0x66, 0x3f, 0x9e, 0x73, 0x9b, 0x53, 0x5b, 0x17, 0xa7, 0x3a, 0x9b, 0xad, + 0x29, 0xa7, 0xe3, 0xc5, 0x53, 0x4e, 0xa7, 0xe3, 0x7b, 0xae, 0x93, 0x78, 0x61, 0x30, 0xb5, 0xf5, + 0xbc, 0xe3, 0x77, 0x36, 0x9c, 0xe7, 0xa7, 0x5a, 0x24, 0x20, 0x91, 0x93, 0x90, 0xe6, 0x64, 0x27, + 0x0a, 0x93, 0x10, 0xfd, 0x88, 0xa6, 0x36, 0x29, 0xa9, 0xb1, 0x1f, 0xaf, 0xbb, 0xcd, 0xc9, 0xad, + 0x8b, 0x93, 0x9d, 0xcd, 0xd6, 0x24, 0xa5, 0x36, 0x69, 0x50, 0x9b, 0x94, 0xd4, 0xce, 0x3f, 0x67, + 0xc8, 0xd2, 0x0a, 0x5b, 0xe1, 0x14, 0x23, 0xba, 0xd6, 0x5d, 0x67, 0xff, 0xd8, 0x1f, 0xf6, 0x8b, + 0x33, 0x3b, 0x6f, 0x6f, 0xbe, 0x14, 0x4f, 0x7a, 0x21, 0x15, 0x6f, 0xca, 0x0d, 0x23, 0x32, 0xb5, + 0xd5, 0x23, 0xd0, 0xf9, 0x2b, 0x1a, 0x87, 0x6c, 0x27, 0x24, 0x88, 0xbd, 0x30, 0x88, 0x9f, 0xa3, + 0x22, 0x90, 0x68, 0x8b, 0x44, 0xe6, 0xeb, 0x19, 0x08, 0x79, 0x94, 0x5e, 0xd0, 0x94, 0xda, 0x8e, + 0xbb, 0xe1, 0x05, 0x24, 0xda, 0xd1, 0x8f, 0xb7, 0x49, 0xe2, 0xe4, 0x3d, 0x35, 0xd5, 0xef, 0xa9, + 0xa8, 0x1b, 0x24, 0x5e, 0x9b, 0xf4, 0x3c, 0xf0, 0xbe, 0xfd, 0x1e, 0x88, 0xdd, 0x0d, 0xd2, 0x76, + 0x7a, 0x9e, 0x7b, 0x6f, 0xbf, 0xe7, 0xba, 0x89, 0xe7, 0x4f, 0x79, 0x41, 0x12, 0x27, 0x51, 0xf6, + 0x21, 0xfb, 0x0d, 0x38, 0x31, 0x7d, 0x6b, 0x65, 0xba, 0x9b, 0x6c, 0xcc, 0x84, 0xc1, 0xba, 0xd7, + 0x42, 0x2f, 0xc2, 0x88, 0xeb, 0x77, 0xe3, 0x84, 0x44, 0xd7, 0x9d, 0x36, 0x19, 0xb7, 0x2e, 0x58, + 0xcf, 0xd4, 0x1b, 0x67, 0xbe, 0xb9, 0x3b, 0xf1, 0x8e, 0xbd, 0xdd, 0x89, 0x91, 0x19, 0x0d, 0xc2, + 0x26, 0x1e, 0x7a, 0x37, 0x0c, 0x47, 0xa1, 0x4f, 0xa6, 0xf1, 0xf5, 0xf1, 0x12, 0x7b, 0xe4, 0x94, + 0x78, 0x64, 0x18, 0xf3, 0x66, 0x2c, 0xe1, 0xf6, 0xef, 0x95, 0x00, 0xa6, 0x3b, 0x9d, 0xe5, 0x28, + 0xbc, 0x4d, 0xdc, 0x04, 0x7d, 0x14, 0x6a, 0xb4, 0xeb, 0x9a, 0x4e, 0xe2, 0x30, 0x6e, 0x23, 0x17, + 0x7f, 0x68, 0x92, 0xbf, 0xc9, 0xa4, 0xf9, 0x26, 0x7a, 0xe0, 0x50, 0xec, 0xc9, 0xad, 0xe7, 0x27, + 0x97, 0xd6, 0xe8, 0xf3, 0x8b, 0x24, 0x71, 0x1a, 0x48, 0x30, 0x03, 0xdd, 0x86, 0x15, 0x55, 0x14, + 0x40, 0x25, 0xee, 0x10, 0x97, 0x09, 0x36, 0x72, 0x71, 0x61, 0xf2, 0x28, 0x23, 0x74, 0x52, 0x4b, + 0xbe, 0xd2, 0x21, 0x6e, 0x63, 0x54, 0x70, 0xae, 0xd0, 0x7f, 0x98, 0xf1, 0x41, 0x5b, 0x30, 0x14, + 0x27, 0x4e, 0xd2, 0x8d, 0xc7, 0xcb, 0x8c, 0xe3, 0xf5, 0xc2, 0x38, 0x32, 0xaa, 0x8d, 0x93, 0x82, + 0xe7, 0x10, 0xff, 0x8f, 0x05, 0x37, 0xfb, 0x8f, 0x2c, 0x38, 0xa9, 0x91, 0x17, 0xbc, 0x38, 0x41, + 0x3f, 0xde, 0xd3, 0xb9, 0x93, 0x83, 0x75, 0x2e, 0x7d, 0x9a, 0x75, 0xed, 0x69, 0xc1, 0xac, 0x26, + 0x5b, 0x8c, 0x8e, 0x6d, 0x43, 0xd5, 0x4b, 0x48, 0x3b, 0x1e, 0x2f, 0x5d, 0x28, 0x3f, 0x33, 0x72, + 0xf1, 0x4a, 0x51, 0xef, 0xd9, 0x38, 0x21, 0x98, 0x56, 0xe7, 0x29, 0x79, 0xcc, 0xb9, 0xd8, 0xbf, + 0x3a, 0x6a, 0xbe, 0x1f, 0xed, 0x70, 0xf4, 0x3c, 0x8c, 0xc4, 0x61, 0x37, 0x72, 0x09, 0x26, 0x9d, + 0x30, 0x1e, 0xb7, 0x2e, 0x94, 0xe9, 0xd0, 0xa3, 0x23, 0x75, 0x45, 0x37, 0x63, 0x13, 0x07, 0x7d, + 0xc1, 0x82, 0xd1, 0x26, 0x89, 0x13, 0x2f, 0x60, 0xfc, 0xa5, 0xf0, 0xab, 0x47, 0x16, 0x5e, 0x36, + 0xce, 0x6a, 0xe2, 0x8d, 0xb3, 0xe2, 0x45, 0x46, 0x8d, 0xc6, 0x18, 0xa7, 0xf8, 0xd3, 0x19, 0xd7, + 0x24, 0xb1, 0x1b, 0x79, 0x1d, 0xfa, 0x9f, 0x8d, 0x19, 0x63, 0xc6, 0xcd, 0x6a, 0x10, 0x36, 0xf1, + 0x50, 0x00, 0x55, 0x3a, 0xa3, 0xe2, 0xf1, 0x0a, 0x93, 0x7f, 0xfe, 0x68, 0xf2, 0x8b, 0x4e, 0xa5, + 0x93, 0x55, 0xf7, 0x3e, 0xfd, 0x17, 0x63, 0xce, 0x06, 0x7d, 0xde, 0x82, 0x71, 0x31, 0xe3, 0x31, + 0xe1, 0x1d, 0x7a, 0x6b, 0xc3, 0x4b, 0x88, 0xef, 0xc5, 0xc9, 0x78, 0x95, 0xc9, 0x30, 0x35, 0xd8, + 0xd8, 0x9a, 0x8b, 0xc2, 0x6e, 0xe7, 0x9a, 0x17, 0x34, 0x1b, 0x17, 0x04, 0xa7, 0xf1, 0x99, 0x3e, + 0x84, 0x71, 0x5f, 0x96, 0xe8, 0x2b, 0x16, 0x9c, 0x0f, 0x9c, 0x36, 0x89, 0x3b, 0x0e, 0xfd, 0xb4, + 0x1c, 0xdc, 0xf0, 0x1d, 0x77, 0x93, 0x49, 0x34, 0x74, 0x38, 0x89, 0x6c, 0x21, 0xd1, 0xf9, 0xeb, + 0x7d, 0x49, 0xe3, 0x7b, 0xb0, 0x45, 0xdf, 0xb0, 0x60, 0x2c, 0x8c, 0x3a, 0x1b, 0x4e, 0x40, 0x9a, + 0x12, 0x1a, 0x8f, 0x0f, 0xb3, 0xa9, 0xf7, 0x91, 0xa3, 0x7d, 0xa2, 0xa5, 0x2c, 0xd9, 0xc5, 0x30, + 0xf0, 0x92, 0x30, 0x5a, 0x21, 0x49, 0xe2, 0x05, 0xad, 0xb8, 0x71, 0x6e, 0x6f, 0x77, 0x62, 0xac, + 0x07, 0x0b, 0xf7, 0xca, 0x83, 0x7e, 0x02, 0x46, 0xe2, 0x9d, 0xc0, 0xbd, 0xe5, 0x05, 0xcd, 0xf0, + 0x4e, 0x3c, 0x5e, 0x2b, 0x62, 0xfa, 0xae, 0x28, 0x82, 0x62, 0x02, 0x6a, 0x06, 0xd8, 0xe4, 0x96, + 0xff, 0xe1, 0xf4, 0x50, 0xaa, 0x17, 0xfd, 0xe1, 0xf4, 0x60, 0xba, 0x07, 0x5b, 0xf4, 0x73, 0x16, + 0x9c, 0x88, 0xbd, 0x56, 0xe0, 0x24, 0xdd, 0x88, 0x5c, 0x23, 0x3b, 0xf1, 0x38, 0x30, 0x41, 0xae, + 0x1e, 0xb1, 0x57, 0x0c, 0x92, 0x8d, 0x73, 0x42, 0xc6, 0x13, 0x66, 0x6b, 0x8c, 0xd3, 0x7c, 0xf3, + 0x26, 0x9a, 0x1e, 0xd6, 0x23, 0xc5, 0x4e, 0x34, 0x3d, 0xa8, 0xfb, 0xb2, 0x44, 0x3f, 0x06, 0xa7, + 0x79, 0x93, 0xea, 0xd9, 0x78, 0x7c, 0x94, 0x29, 0xda, 0xb3, 0x7b, 0xbb, 0x13, 0xa7, 0x57, 0x32, + 0x30, 0xdc, 0x83, 0x8d, 0xde, 0x80, 0x89, 0x0e, 0x89, 0xda, 0x5e, 0xb2, 0x14, 0xf8, 0x3b, 0x52, + 0x7d, 0xbb, 0x61, 0x87, 0x34, 0x85, 0x38, 0xf1, 0xf8, 0x89, 0x0b, 0xd6, 0x33, 0xb5, 0xc6, 0xbb, + 0x84, 0x98, 0x13, 0xcb, 0xf7, 0x46, 0xc7, 0xfb, 0xd1, 0xb3, 0xff, 0x45, 0x09, 0x4e, 0x67, 0x17, + 0x4e, 0xf4, 0x37, 0x2d, 0x38, 0x75, 0xfb, 0x4e, 0xb2, 0x1a, 0x6e, 0x92, 0x20, 0x6e, 0xec, 0x50, + 0xf5, 0xc6, 0x96, 0x8c, 0x91, 0x8b, 0x6e, 0xb1, 0x4b, 0xf4, 0xe4, 0xd5, 0x34, 0x97, 0x4b, 0x41, + 0x12, 0xed, 0x34, 0x1e, 0x15, 0x6f, 0x77, 0xea, 0xea, 0xad, 0x55, 0x13, 0x8a, 0xb3, 0x42, 0x9d, + 0xff, 0xac, 0x05, 0x67, 0xf3, 0x48, 0xa0, 0xd3, 0x50, 0xde, 0x24, 0x3b, 0xdc, 0x2a, 0xc3, 0xf4, + 0x27, 0x7a, 0x0d, 0xaa, 0x5b, 0x8e, 0xdf, 0x25, 0xc2, 0xba, 0x99, 0x3b, 0xda, 0x8b, 0x28, 0xc9, + 0x30, 0xa7, 0xfa, 0xc3, 0xa5, 0x97, 0x2c, 0xfb, 0x5f, 0x97, 0x61, 0xc4, 0x58, 0xdf, 0xee, 0x83, + 0xc5, 0x16, 0xa6, 0x2c, 0xb6, 0xc5, 0xc2, 0x96, 0xe6, 0xbe, 0x26, 0xdb, 0x9d, 0x8c, 0xc9, 0xb6, + 0x54, 0x1c, 0xcb, 0x7b, 0xda, 0x6c, 0x28, 0x81, 0x7a, 0xd8, 0xa1, 0x16, 0x39, 0x5d, 0xfa, 0x2b, + 0x45, 0x7c, 0xc2, 0x25, 0x49, 0xae, 0x71, 0x62, 0x6f, 0x77, 0xa2, 0xae, 0xfe, 0x62, 0xcd, 0xc8, + 0xfe, 0xb6, 0x05, 0x67, 0x0d, 0x19, 0x67, 0xc2, 0xa0, 0xe9, 0xb1, 0x4f, 0x7b, 0x01, 0x2a, 0xc9, + 0x4e, 0x47, 0x9a, 0xfd, 0xaa, 0xa7, 0x56, 0x77, 0x3a, 0x04, 0x33, 0x08, 0x35, 0xf4, 0xdb, 0x24, + 0x8e, 0x9d, 0x16, 0xc9, 0x1a, 0xfa, 0x8b, 0xbc, 0x19, 0x4b, 0x38, 0x8a, 0x00, 0xf9, 0x4e, 0x9c, + 0xac, 0x46, 0x4e, 0x10, 0x33, 0xf2, 0xab, 0x5e, 0x9b, 0x88, 0x0e, 0xfe, 0x33, 0x83, 0x8d, 0x18, + 0xfa, 0x44, 0xe3, 0x91, 0xbd, 0xdd, 0x09, 0xb4, 0xd0, 0x43, 0x09, 0xe7, 0x50, 0xb7, 0xbf, 0x62, + 0xc1, 0x23, 0xf9, 0xb6, 0x18, 0x7a, 0x1a, 0x86, 0xf8, 0x96, 0x4f, 0xbc, 0x9d, 0xfe, 0x24, 0xac, + 0x15, 0x0b, 0x28, 0x9a, 0x82, 0xba, 0x5a, 0x27, 0xc4, 0x3b, 0x8e, 0x09, 0xd4, 0xba, 0x5e, 0x5c, + 0x34, 0x0e, 0xed, 0x34, 0xfa, 0x47, 0x58, 0x6e, 0xaa, 0xd3, 0xd8, 0x26, 0x89, 0x41, 0xec, 0x7f, + 0x6f, 0xc1, 0x29, 0x43, 0xaa, 0xfb, 0x60, 0x9a, 0x07, 0x69, 0xd3, 0x7c, 0xbe, 0xb0, 0xf1, 0xdc, + 0xc7, 0x36, 0xff, 0xbc, 0x05, 0xe7, 0x0d, 0xac, 0x45, 0x27, 0x71, 0x37, 0x2e, 0x6d, 0x77, 0x22, + 0x12, 0xd3, 0xed, 0x34, 0x7a, 0xc2, 0xd0, 0x5b, 0x8d, 0x11, 0x41, 0xa1, 0x7c, 0x8d, 0xec, 0x70, + 0x25, 0xf6, 0x2c, 0xd4, 0xf8, 0xe0, 0x0c, 0x23, 0xd1, 0xe3, 0xea, 0xdd, 0x96, 0x44, 0x3b, 0x56, + 0x18, 0xc8, 0x86, 0x21, 0xa6, 0x9c, 0xe8, 0x64, 0xa5, 0xcb, 0x10, 0xd0, 0x8f, 0x78, 0x93, 0xb5, + 0x60, 0x01, 0xb1, 0x97, 0x52, 0xe2, 0x2c, 0x47, 0x84, 0x7d, 0xdc, 0xe6, 0x65, 0x8f, 0xf8, 0xcd, + 0x98, 0x6e, 0x1b, 0x9c, 0x20, 0x08, 0x13, 0xb1, 0x03, 0x30, 0xb6, 0x0d, 0xd3, 0xba, 0x19, 0x9b, + 0x38, 0xf6, 0x5e, 0x89, 0x6d, 0x3e, 0xd4, 0xb4, 0x26, 0xf7, 0x63, 0xe7, 0x1a, 0xa5, 0xf4, 0xe0, + 0x72, 0x71, 0x4a, 0x89, 0xf4, 0xdf, 0xbd, 0xbe, 0x99, 0x51, 0x85, 0xb8, 0x50, 0xae, 0xf7, 0xde, + 0xc1, 0xfe, 0x56, 0x09, 0x26, 0xd2, 0x0f, 0xf4, 0x68, 0x52, 0xba, 0x5d, 0x32, 0x18, 0x65, 0x1d, + 0x14, 0x06, 0x3e, 0x36, 0xf1, 0xfa, 0x28, 0xa3, 0xd2, 0x71, 0x2a, 0x23, 0x53, 0x57, 0x96, 0xf7, + 0xd1, 0x95, 0x4f, 0xab, 0x5e, 0xaf, 0x64, 0x94, 0x53, 0x7a, 0xbd, 0xb8, 0x00, 0x95, 0x38, 0x21, + 0x9d, 0xf1, 0x6a, 0x5a, 0xd7, 0xac, 0x24, 0xa4, 0x83, 0x19, 0xc4, 0xfe, 0x2f, 0x25, 0x78, 0x34, + 0xdd, 0x87, 0x5a, 0xbd, 0x7f, 0x20, 0xa5, 0xde, 0xdf, 0x63, 0xaa, 0xf7, 0xbb, 0xbb, 0x13, 0xef, + 0xec, 0xf3, 0xd8, 0xf7, 0x8c, 0xf6, 0x47, 0x73, 0x99, 0x5e, 0x9c, 0x4a, 0xf7, 0xe2, 0xdd, 0xdd, + 0x89, 0x27, 0xfa, 0xbc, 0x63, 0xa6, 0x9b, 0x9f, 0x86, 0xa1, 0x88, 0x38, 0x71, 0x18, 0x88, 0x8e, + 0x56, 0x9f, 0x03, 0xb3, 0x56, 0x2c, 0xa0, 0xf6, 0xbf, 0xa9, 0x67, 0x3b, 0x7b, 0x8e, 0x3b, 0xd8, + 0xc2, 0x08, 0x79, 0x50, 0x61, 0x26, 0x3b, 0x57, 0x0d, 0xd7, 0x8e, 0x36, 0x8d, 0xa8, 0x8a, 0x57, + 0xa4, 0x1b, 0x35, 0xfa, 0xd5, 0x68, 0x13, 0x66, 0x2c, 0xd0, 0x36, 0xd4, 0x5c, 0x69, 0x49, 0x97, + 0x8a, 0xf0, 0x39, 0x09, 0x3b, 0x5a, 0x73, 0x1c, 0xa5, 0xba, 0x58, 0x99, 0xdf, 0x8a, 0x1b, 0x22, + 0x50, 0x6e, 0x79, 0x89, 0xf8, 0xac, 0x47, 0xdc, 0x2b, 0xcd, 0x79, 0xc6, 0x2b, 0x0e, 0xd3, 0x05, + 0x62, 0xce, 0x4b, 0x30, 0xa5, 0x8f, 0x7e, 0xc6, 0x82, 0x91, 0xd8, 0x6d, 0x2f, 0x47, 0xe1, 0x96, + 0xd7, 0x24, 0x91, 0xb0, 0x94, 0x8e, 0xa8, 0x9a, 0x56, 0x66, 0x16, 0x25, 0x41, 0xcd, 0x97, 0xef, + 0x5d, 0x35, 0x04, 0x9b, 0x7c, 0xe9, 0x0e, 0xe2, 0x51, 0xf1, 0xee, 0xb3, 0xc4, 0xf5, 0xe8, 0xda, + 0x26, 0x37, 0x4c, 0x6c, 0xa4, 0x1c, 0xd9, 0x72, 0x9c, 0xed, 0xba, 0x9b, 0x74, 0xbe, 0x69, 0x81, + 0xde, 0xb9, 0xb7, 0x3b, 0xf1, 0xe8, 0x4c, 0x3e, 0x4f, 0xdc, 0x4f, 0x18, 0xd6, 0x61, 0x9d, 0xae, + 0xef, 0x63, 0xf2, 0x46, 0x97, 0x30, 0x77, 0x48, 0x01, 0x1d, 0xb6, 0xac, 0x09, 0x66, 0x3a, 0xcc, + 0x80, 0x60, 0x93, 0x2f, 0x7a, 0x03, 0x86, 0xda, 0x4e, 0x12, 0x79, 0xdb, 0xc2, 0x07, 0x72, 0x44, + 0x5b, 0x7e, 0x91, 0xd1, 0xd2, 0xcc, 0xd9, 0xd2, 0xcf, 0x1b, 0xb1, 0x60, 0x84, 0xda, 0x50, 0x6d, + 0x93, 0xa8, 0x45, 0xc6, 0x6b, 0x45, 0xf8, 0x7b, 0x17, 0x29, 0x29, 0xcd, 0xb0, 0x4e, 0x2d, 0x1f, + 0xd6, 0x86, 0x39, 0x17, 0xf4, 0x1a, 0xd4, 0x62, 0xe2, 0x13, 0x97, 0xda, 0x2e, 0x75, 0xc6, 0xf1, + 0xbd, 0x03, 0xda, 0x71, 0xce, 0x1a, 0xf1, 0x57, 0xc4, 0xa3, 0x7c, 0x82, 0xc9, 0x7f, 0x58, 0x91, + 0xa4, 0x1d, 0xd8, 0xf1, 0xbb, 0x2d, 0x2f, 0x18, 0x87, 0x22, 0x3a, 0x70, 0x99, 0xd1, 0xca, 0x74, + 0x20, 0x6f, 0xc4, 0x82, 0x91, 0xfd, 0x1f, 0x2d, 0x40, 0x69, 0xa5, 0x76, 0x1f, 0x0c, 0xd6, 0x37, + 0xd2, 0x06, 0xeb, 0x42, 0x91, 0x56, 0x47, 0x1f, 0x9b, 0xf5, 0x37, 0xea, 0x90, 0x59, 0x0e, 0xae, + 0x93, 0x38, 0x21, 0xcd, 0xb7, 0x55, 0xf8, 0xdb, 0x2a, 0xfc, 0x6d, 0x15, 0xae, 0x54, 0xf8, 0x5a, + 0x46, 0x85, 0xbf, 0xdf, 0x98, 0xf5, 0xfa, 0xc0, 0xf4, 0x75, 0x75, 0xa2, 0x6a, 0x4a, 0x60, 0x20, + 0x50, 0x4d, 0x70, 0x75, 0x65, 0xe9, 0x7a, 0xae, 0xce, 0x7e, 0x3d, 0xad, 0xb3, 0x8f, 0xca, 0xe2, + 0x4f, 0x83, 0x96, 0xfe, 0xab, 0x25, 0x78, 0x2c, 0xad, 0xbd, 0x70, 0xe8, 0xfb, 0x61, 0x37, 0xa1, + 0x7b, 0x01, 0xf4, 0x8b, 0x16, 0x9c, 0x6e, 0xa7, 0x37, 0xe1, 0xb1, 0xf0, 0x75, 0x7e, 0xb0, 0x30, + 0xd5, 0x9a, 0xd9, 0xe5, 0x37, 0xc6, 0x85, 0x9a, 0x3d, 0x9d, 0x01, 0xc4, 0xb8, 0x47, 0x16, 0xf4, + 0x1a, 0xd4, 0xdb, 0xce, 0xf6, 0x8d, 0x4e, 0xd3, 0x49, 0xe4, 0x36, 0xac, 0xff, 0xee, 0xb9, 0x9b, + 0x78, 0xfe, 0x24, 0x3f, 0xc1, 0x9e, 0x9c, 0x0f, 0x92, 0xa5, 0x68, 0x25, 0x89, 0xbc, 0xa0, 0xc5, + 0x3d, 0x5c, 0x8b, 0x92, 0x0c, 0xd6, 0x14, 0xed, 0xaf, 0x59, 0x59, 0xdd, 0xae, 0x7a, 0x27, 0x72, + 0x12, 0xd2, 0xda, 0x41, 0x1f, 0x83, 0x2a, 0xdd, 0x2f, 0xc9, 0x5e, 0xb9, 0x55, 0xe4, 0x82, 0x63, + 0x7c, 0x09, 0xbd, 0xf6, 0xd0, 0x7f, 0x31, 0xe6, 0x4c, 0xed, 0xaf, 0x0c, 0x67, 0xd7, 0x58, 0x76, + 0x9e, 0x79, 0x11, 0xa0, 0x15, 0xae, 0x92, 0x76, 0xc7, 0xa7, 0xdd, 0x62, 0x31, 0xa7, 0xb8, 0x72, + 0x11, 0xcc, 0x29, 0x08, 0x36, 0xb0, 0xd0, 0x9f, 0xb7, 0x00, 0x5a, 0x72, 0xa8, 0xc8, 0xf5, 0xf3, + 0x46, 0x91, 0xaf, 0xa3, 0x07, 0xa2, 0x96, 0x45, 0x31, 0xc4, 0x06, 0x73, 0xf4, 0x53, 0x16, 0xd4, + 0x12, 0x29, 0x3e, 0x5f, 0x51, 0x56, 0x8b, 0x94, 0x44, 0xbe, 0xb4, 0x36, 0x25, 0x54, 0x97, 0x28, + 0xbe, 0xe8, 0x67, 0x2d, 0x80, 0x78, 0x27, 0x70, 0x97, 0x43, 0xdf, 0x73, 0x77, 0xc4, 0x42, 0x73, + 0xb3, 0x50, 0x37, 0x86, 0xa2, 0xde, 0x38, 0x49, 0x7b, 0x43, 0xff, 0xc7, 0x06, 0x67, 0xf4, 0x09, + 0xa8, 0xc5, 0x62, 0xb8, 0x89, 0xa5, 0x65, 0xb5, 0x58, 0x67, 0x0a, 0xa7, 0x2d, 0xb4, 0x92, 0xf8, + 0x87, 0x15, 0x4f, 0xf4, 0xf3, 0x16, 0x9c, 0xea, 0xa4, 0x5d, 0x5f, 0x62, 0x15, 0x29, 0x4e, 0x07, + 0x64, 0x5c, 0x6b, 0x8d, 0x33, 0x7b, 0xbb, 0x13, 0xa7, 0x32, 0x8d, 0x38, 0x2b, 0x05, 0x9a, 0x81, + 0x31, 0x3d, 0x82, 0x97, 0x3a, 0xdc, 0x0d, 0x37, 0xcc, 0xdc, 0x70, 0xec, 0x14, 0x73, 0x2e, 0x0b, + 0xc4, 0xbd, 0xf8, 0x68, 0x19, 0xce, 0x52, 0xe9, 0x76, 0xb8, 0xd5, 0x26, 0xb5, 0x72, 0xcc, 0xd6, + 0x90, 0x5a, 0xe3, 0x71, 0x31, 0x42, 0x98, 0xa3, 0x3b, 0x8b, 0x83, 0x73, 0x9f, 0xb4, 0xbf, 0x55, + 0x4a, 0xf9, 0xc5, 0x95, 0xc3, 0x8a, 0xcd, 0x31, 0x57, 0xfa, 0x0a, 0xa4, 0xca, 0x28, 0x74, 0x8e, + 0x29, 0x4f, 0x84, 0x9e, 0x63, 0xaa, 0x29, 0xc6, 0x06, 0x73, 0x6a, 0xc0, 0x8c, 0x39, 0x59, 0xb7, + 0x98, 0x98, 0xf6, 0xaf, 0x15, 0x29, 0x52, 0xef, 0x29, 0xc6, 0x63, 0x42, 0xb4, 0xb1, 0x1e, 0x10, + 0xee, 0x15, 0xc9, 0xfe, 0x56, 0xda, 0x17, 0x6f, 0x8c, 0xd8, 0x01, 0xce, 0x19, 0xbe, 0x60, 0xc1, + 0x48, 0x14, 0xfa, 0xbe, 0x17, 0xb4, 0xe8, 0xec, 0x12, 0x4b, 0xc4, 0x87, 0x8f, 0x45, 0x4b, 0x8b, + 0x69, 0xc4, 0xcc, 0x20, 0xac, 0x79, 0x62, 0x53, 0x00, 0xfb, 0x8f, 0x2c, 0x18, 0xef, 0xa7, 0x05, + 0x10, 0x81, 0x77, 0xca, 0x21, 0xae, 0x4e, 0xd9, 0x97, 0x82, 0x59, 0xe2, 0x13, 0xe5, 0xa4, 0xac, + 0x35, 0x9e, 0x12, 0xaf, 0xf9, 0xce, 0xe5, 0xfe, 0xa8, 0xf8, 0x5e, 0x74, 0xd0, 0xab, 0x70, 0xda, + 0x78, 0xaf, 0x58, 0x75, 0x4c, 0xbd, 0x31, 0x49, 0x97, 0xdd, 0xe9, 0x0c, 0xec, 0xee, 0xee, 0xc4, + 0x23, 0xd9, 0x36, 0xa1, 0xa6, 0x7a, 0xe8, 0xd8, 0xbf, 0x52, 0xca, 0x7e, 0x2d, 0xb5, 0xc2, 0x7c, + 0xd5, 0xea, 0xd9, 0xfa, 0x7d, 0xf0, 0x38, 0xb4, 0x3a, 0xdb, 0x24, 0xaa, 0x83, 0xfc, 0xfe, 0x38, + 0x0f, 0xf0, 0xa4, 0xd0, 0xfe, 0x97, 0x15, 0xb8, 0x87, 0x64, 0xea, 0x2c, 0xc8, 0xea, 0x77, 0x16, + 0x74, 0xf0, 0xe3, 0xa5, 0xcf, 0x59, 0x30, 0xe4, 0x53, 0x2b, 0x94, 0x9f, 0x77, 0x8c, 0x5c, 0x6c, + 0x1e, 0x57, 0xdf, 0x73, 0x63, 0x37, 0xe6, 0xa7, 0xd5, 0xca, 0xe5, 0xc9, 0x1b, 0xb1, 0x90, 0x01, + 0x7d, 0xdd, 0x4a, 0x1f, 0x9e, 0xf0, 0xf0, 0x23, 0xef, 0xd8, 0x64, 0x32, 0x4e, 0x64, 0xb8, 0x60, + 0xda, 0xd7, 0xdf, 0xe7, 0xac, 0x06, 0x4d, 0x02, 0xac, 0x7b, 0x81, 0xe3, 0x7b, 0x6f, 0xd2, 0xdd, + 0x74, 0x95, 0x2d, 0x2b, 0x6c, 0x9d, 0xbe, 0xac, 0x5a, 0xb1, 0x81, 0x71, 0xfe, 0xcf, 0xc1, 0x88, + 0xf1, 0xe6, 0x39, 0x87, 0xec, 0x67, 0xcd, 0x43, 0xf6, 0xba, 0x71, 0x36, 0x7e, 0xfe, 0xfd, 0x70, + 0x3a, 0x2b, 0xe0, 0x41, 0x9e, 0xb7, 0xff, 0xe7, 0x70, 0xf6, 0xc4, 0x63, 0x95, 0x44, 0x6d, 0x2a, + 0xda, 0xdb, 0x5e, 0x88, 0xb7, 0xbd, 0x10, 0x6f, 0x7b, 0x21, 0x4c, 0x47, 0xb2, 0xd8, 0x61, 0x0f, + 0xdf, 0xa7, 0x1d, 0x76, 0xca, 0x67, 0x50, 0x2b, 0xdc, 0x67, 0x60, 0xef, 0x55, 0x21, 0x65, 0x47, + 0xf1, 0xfe, 0x7e, 0x37, 0x0c, 0x47, 0xa4, 0x13, 0xde, 0xc0, 0x0b, 0x62, 0x0d, 0xd1, 0x81, 0xd4, + 0xbc, 0x19, 0x4b, 0x38, 0x5d, 0x6b, 0x3a, 0x4e, 0xb2, 0x21, 0x16, 0x11, 0xb5, 0xd6, 0x2c, 0x3b, + 0xc9, 0x06, 0x66, 0x10, 0xf4, 0x7e, 0x38, 0x99, 0x38, 0x51, 0x8b, 0x24, 0x98, 0x6c, 0xb1, 0xcf, + 0x2a, 0xce, 0xc5, 0x1e, 0x11, 0xb8, 0x27, 0x57, 0x53, 0x50, 0x9c, 0xc1, 0x46, 0x6f, 0x40, 0x65, + 0x83, 0xf8, 0x6d, 0xd1, 0xe5, 0x2b, 0xc5, 0xe9, 0x78, 0xf6, 0xae, 0x57, 0x88, 0xdf, 0xe6, 0x1a, + 0x88, 0xfe, 0xc2, 0x8c, 0x15, 0x1d, 0x6f, 0xf5, 0xcd, 0x6e, 0x9c, 0x84, 0x6d, 0xef, 0x4d, 0xe9, + 0x0e, 0xfa, 0x60, 0xc1, 0x8c, 0xaf, 0x49, 0xfa, 0xdc, 0x81, 0xa0, 0xfe, 0x62, 0xcd, 0x99, 0xc9, + 0xd1, 0xf4, 0x22, 0xf6, 0xa9, 0x76, 0x84, 0x57, 0xa7, 0x68, 0x39, 0x66, 0x25, 0x7d, 0x2e, 0x87, + 0xfa, 0x8b, 0x35, 0x67, 0xb4, 0xa3, 0xc6, 0xfd, 0x08, 0x93, 0xe1, 0x46, 0xc1, 0x32, 0xf0, 0x31, + 0x9f, 0x3b, 0xfe, 0x9f, 0x82, 0xaa, 0xbb, 0xe1, 0x44, 0xc9, 0xf8, 0x28, 0x1b, 0x34, 0xca, 0x91, + 0x31, 0x43, 0x1b, 0x31, 0x87, 0xa1, 0x27, 0xa0, 0x1c, 0x91, 0x75, 0x16, 0xbf, 0x67, 0x44, 0x76, + 0x60, 0xb2, 0x8e, 0x69, 0xbb, 0xfd, 0x4b, 0xa5, 0xb4, 0xb9, 0x94, 0x7e, 0x6f, 0x3e, 0xda, 0xdd, + 0x6e, 0x14, 0x4b, 0x67, 0x87, 0x31, 0xda, 0x59, 0x33, 0x96, 0x70, 0xf4, 0x29, 0x0b, 0x86, 0x6f, + 0xc7, 0x61, 0x10, 0x90, 0x44, 0x2c, 0x4d, 0x37, 0x0b, 0xee, 0x8a, 0xab, 0x9c, 0xba, 0x96, 0x41, + 0x34, 0x60, 0xc9, 0x97, 0x8a, 0x4b, 0xb6, 0x5d, 0xbf, 0xdb, 0xec, 0x39, 0xd0, 0xbf, 0xc4, 0x9b, + 0xb1, 0x84, 0x53, 0x54, 0x2f, 0xe0, 0xa8, 0x95, 0x34, 0xea, 0x7c, 0x20, 0x50, 0x05, 0xdc, 0xfe, + 0xcb, 0x43, 0x70, 0x2e, 0x77, 0x72, 0x50, 0x43, 0x86, 0x99, 0x0a, 0x97, 0x3d, 0x9f, 0xc8, 0x30, + 0x15, 0x66, 0xc8, 0xdc, 0x54, 0xad, 0xd8, 0xc0, 0x40, 0x3f, 0x09, 0xd0, 0x71, 0x22, 0xa7, 0x4d, + 0xc4, 0x02, 0x5e, 0x3e, 0xba, 0xbd, 0x40, 0xe5, 0x58, 0x96, 0x34, 0xf5, 0xde, 0x54, 0x35, 0xc5, + 0xd8, 0x60, 0x89, 0x5e, 0x84, 0x91, 0x88, 0xf8, 0xc4, 0x89, 0x59, 0xf8, 0x67, 0x36, 0x96, 0x1d, + 0x6b, 0x10, 0x36, 0xf1, 0xd0, 0xd3, 0x2a, 0xa2, 0x27, 0x13, 0xfd, 0x90, 0x8e, 0xea, 0x41, 0x5f, + 0xb4, 0xe0, 0xe4, 0xba, 0xe7, 0x13, 0xcd, 0x5d, 0x44, 0x9e, 0x2f, 0x1d, 0xfd, 0x25, 0x2f, 0x9b, + 0x74, 0xb5, 0x86, 0x4c, 0x35, 0xc7, 0x38, 0xc3, 0x9e, 0x7e, 0xe6, 0x2d, 0x12, 0x31, 0xd5, 0x3a, + 0x94, 0xfe, 0xcc, 0x37, 0x79, 0x33, 0x96, 0x70, 0x34, 0x0d, 0xa7, 0x3a, 0x4e, 0x1c, 0xcf, 0x44, + 0xa4, 0x49, 0x82, 0xc4, 0x73, 0x7c, 0x1e, 0x17, 0x5e, 0xd3, 0x71, 0xa1, 0xcb, 0x69, 0x30, 0xce, + 0xe2, 0xa3, 0x0f, 0xc1, 0xa3, 0x5e, 0x2b, 0x08, 0x23, 0xb2, 0xe8, 0xc5, 0xb1, 0x17, 0xb4, 0xf4, + 0x30, 0x10, 0x4e, 0x8f, 0x09, 0x41, 0xea, 0xd1, 0xf9, 0x7c, 0x34, 0xdc, 0xef, 0x79, 0xf4, 0x2c, + 0xd4, 0xe2, 0x4d, 0xaf, 0x33, 0x13, 0x35, 0x63, 0xe6, 0x20, 0xaf, 0x69, 0x17, 0xdb, 0x8a, 0x68, + 0xc7, 0x0a, 0x03, 0xb9, 0x30, 0xca, 0x3f, 0x09, 0x0f, 0x5b, 0x12, 0xfa, 0xf1, 0xb9, 0xbe, 0xcb, + 0xa3, 0x48, 0x5d, 0x9a, 0xc4, 0xce, 0x9d, 0x4b, 0xd2, 0x5d, 0xdf, 0x38, 0xbd, 0xb7, 0x3b, 0x31, + 0x7a, 0xd3, 0x20, 0x83, 0x53, 0x44, 0xed, 0x5f, 0x28, 0xa5, 0x77, 0xdc, 0xe6, 0x24, 0x45, 0x31, + 0x9d, 0x8a, 0xc9, 0x4d, 0x27, 0x92, 0xde, 0x98, 0x23, 0x86, 0xaf, 0x0b, 0xba, 0x37, 0x9d, 0xc8, + 0x9c, 0xd4, 0x8c, 0x01, 0x96, 0x9c, 0xd0, 0x6d, 0xa8, 0x24, 0xbe, 0x53, 0x50, 0xbe, 0x8b, 0xc1, + 0x51, 0x3b, 0x40, 0x16, 0xa6, 0x63, 0xcc, 0x78, 0xa0, 0xc7, 0xa9, 0xd5, 0xbf, 0x26, 0x63, 0xdc, + 0x84, 0xa1, 0xbe, 0x16, 0x63, 0xd6, 0x6a, 0xff, 0xbf, 0x5a, 0x8e, 0x5e, 0x55, 0x0b, 0x19, 0xba, + 0x08, 0x40, 0x37, 0x90, 0xcb, 0x11, 0x59, 0xf7, 0xb6, 0x85, 0x21, 0xa1, 0xe6, 0xee, 0x75, 0x05, + 0xc1, 0x06, 0x96, 0x7c, 0x66, 0xa5, 0xbb, 0x4e, 0x9f, 0x29, 0xf5, 0x3e, 0xc3, 0x21, 0xd8, 0xc0, + 0x42, 0x2f, 0xc0, 0x90, 0xd7, 0x76, 0x5a, 0x2a, 0x14, 0xef, 0x71, 0x3a, 0x69, 0xe7, 0x59, 0xcb, + 0xdd, 0xdd, 0x89, 0x93, 0x4a, 0x20, 0xd6, 0x84, 0x05, 0x2e, 0xfa, 0x15, 0x0b, 0x46, 0xdd, 0xb0, + 0xdd, 0x0e, 0x03, 0xbe, 0xed, 0x12, 0x7b, 0xc8, 0xdb, 0xc7, 0xb5, 0xcc, 0x4f, 0xce, 0x18, 0xcc, + 0xf8, 0x26, 0x52, 0x25, 0xe6, 0x98, 0x20, 0x9c, 0x92, 0xca, 0x9c, 0xdb, 0xd5, 0x7d, 0xe6, 0xf6, + 0xaf, 0x5b, 0x30, 0xc6, 0x9f, 0x35, 0x76, 0x83, 0x22, 0x07, 0x25, 0x3c, 0xe6, 0xd7, 0xea, 0xd9, + 0x20, 0x2b, 0x2f, 0x5d, 0x0f, 0x1c, 0xf7, 0x0a, 0x89, 0xe6, 0x60, 0x6c, 0x3d, 0x8c, 0x5c, 0x62, + 0x76, 0x84, 0x50, 0x4c, 0x8a, 0xd0, 0xe5, 0x2c, 0x02, 0xee, 0x7d, 0x06, 0xdd, 0x84, 0x47, 0x8c, + 0x46, 0xb3, 0x1f, 0xb8, 0x6e, 0x7a, 0x52, 0x50, 0x7b, 0xe4, 0x72, 0x2e, 0x16, 0xee, 0xf3, 0x74, + 0xda, 0x61, 0x52, 0x1f, 0xc0, 0x61, 0xf2, 0x3a, 0x3c, 0xe6, 0xf6, 0xf6, 0xcc, 0x56, 0xdc, 0x5d, + 0x8b, 0xb9, 0xa6, 0xaa, 0x35, 0x7e, 0x40, 0x10, 0x78, 0x6c, 0xa6, 0x1f, 0x22, 0xee, 0x4f, 0x03, + 0x7d, 0x0c, 0x6a, 0x11, 0x61, 0x5f, 0x25, 0x16, 0x09, 0x19, 0x47, 0xdc, 0x25, 0x6b, 0x0b, 0x94, + 0x93, 0xd5, 0xba, 0x57, 0x34, 0xc4, 0x58, 0x71, 0x3c, 0xff, 0x01, 0x18, 0xeb, 0x19, 0xcf, 0x07, + 0xf2, 0x59, 0xcc, 0xc2, 0x23, 0xf9, 0x23, 0xe7, 0x40, 0x9e, 0x8b, 0x7f, 0x90, 0x89, 0x33, 0x34, + 0xac, 0xc9, 0x01, 0xbc, 0x60, 0x0e, 0x94, 0x49, 0xb0, 0x25, 0x14, 0xe9, 0xe5, 0xa3, 0xf5, 0xde, + 0xa5, 0x60, 0x8b, 0x0f, 0x7c, 0xb6, 0xd5, 0xbf, 0x14, 0x6c, 0x61, 0x4a, 0x1b, 0x7d, 0xd9, 0x4a, + 0x59, 0x43, 0xdc, 0x77, 0xf6, 0x91, 0x63, 0x31, 0x9f, 0x07, 0x36, 0x90, 0xec, 0x7f, 0x55, 0x82, + 0x0b, 0xfb, 0x11, 0x19, 0xa0, 0xfb, 0x9e, 0x82, 0xa1, 0x98, 0x1d, 0x81, 0x0a, 0xcd, 0x34, 0x42, + 0xb5, 0x12, 0x3f, 0x14, 0x7d, 0x1d, 0x0b, 0x10, 0xf2, 0xa1, 0xdc, 0x76, 0x3a, 0xc2, 0xa5, 0x32, + 0x7f, 0xd4, 0xac, 0x02, 0xfa, 0xdf, 0xf1, 0x17, 0x9d, 0x0e, 0xdf, 0xa8, 0x1b, 0x0d, 0x98, 0xb2, + 0x41, 0x09, 0x54, 0x9d, 0x28, 0x72, 0xe4, 0x79, 0xdb, 0xb5, 0x62, 0xf8, 0x4d, 0x53, 0x92, 0x8d, + 0xb1, 0xbd, 0xdd, 0x89, 0x13, 0xa9, 0x26, 0xcc, 0x99, 0xd9, 0x9f, 0x1b, 0x4e, 0x45, 0xd6, 0xb3, + 0x43, 0xd4, 0x18, 0x86, 0x84, 0x27, 0xc5, 0x2a, 0x3a, 0x99, 0x83, 0xa7, 0x46, 0xb1, 0xcd, 0x92, + 0x48, 0x30, 0x15, 0xac, 0xd0, 0x67, 0x2d, 0x96, 0xc6, 0x29, 0xb3, 0x0d, 0xc4, 0x16, 0xe5, 0x78, + 0xb2, 0x4a, 0xcd, 0xe4, 0x50, 0xd9, 0x88, 0x4d, 0xee, 0x74, 0xe9, 0xea, 0xf0, 0x84, 0xa4, 0xec, + 0x46, 0x45, 0x26, 0x7a, 0x4a, 0x38, 0xda, 0xce, 0x39, 0x2c, 0x2d, 0x20, 0x15, 0x70, 0x80, 0xe3, + 0xd1, 0xaf, 0x5b, 0x30, 0xc6, 0xcd, 0xd1, 0x59, 0x6f, 0x7d, 0x9d, 0x44, 0x24, 0x70, 0x89, 0x34, + 0xe8, 0x8f, 0x78, 0x1c, 0x2f, 0xdd, 0x57, 0xf3, 0x59, 0xf2, 0x7a, 0x4d, 0xeb, 0x01, 0xe1, 0x5e, + 0x61, 0x50, 0x13, 0x2a, 0x5e, 0xb0, 0x1e, 0x8a, 0x95, 0xbc, 0x71, 0x34, 0xa1, 0xe6, 0x83, 0xf5, + 0x50, 0xcf, 0x66, 0xfa, 0x0f, 0x33, 0xea, 0x68, 0x01, 0xce, 0x46, 0xc2, 0xe5, 0x72, 0xc5, 0x8b, + 0xe9, 0xc6, 0x78, 0xc1, 0x6b, 0x7b, 0x09, 0x5b, 0x85, 0xcb, 0x8d, 0xf1, 0xbd, 0xdd, 0x89, 0xb3, + 0x38, 0x07, 0x8e, 0x73, 0x9f, 0x42, 0x6f, 0xc2, 0xb0, 0xcc, 0x3b, 0xad, 0x15, 0xb1, 0x39, 0xea, + 0x1d, 0xff, 0x6a, 0x30, 0xad, 0x88, 0x14, 0x53, 0xc9, 0xd0, 0xfe, 0xe2, 0x08, 0xf4, 0x9e, 0x0d, + 0xa2, 0x8f, 0x43, 0x3d, 0x52, 0xb9, 0xb0, 0x56, 0x11, 0xf1, 0x7d, 0xf2, 0xfb, 0x8a, 0x73, 0x49, + 0x65, 0x0f, 0xe8, 0xac, 0x57, 0xcd, 0x91, 0x5a, 0xed, 0xb1, 0x3e, 0x42, 0x2c, 0x60, 0x6c, 0x0b, + 0xae, 0xfa, 0x78, 0x68, 0x27, 0x70, 0x31, 0xe3, 0x81, 0x22, 0x18, 0xda, 0x20, 0x8e, 0x9f, 0x6c, + 0x14, 0xe3, 0xc9, 0xbe, 0xc2, 0x68, 0x65, 0xb3, 0x26, 0x78, 0x2b, 0x16, 0x9c, 0xd0, 0x36, 0x0c, + 0x6f, 0xf0, 0x01, 0x20, 0x0c, 0xe9, 0xc5, 0xa3, 0x76, 0x6e, 0x6a, 0x54, 0xe9, 0xcf, 0x2d, 0x1a, + 0xb0, 0x64, 0xc7, 0x22, 0x2d, 0x8c, 0x63, 0x71, 0x3e, 0x75, 0x8b, 0x4b, 0x18, 0x19, 0xfc, 0x4c, + 0xfc, 0xa3, 0x30, 0x1a, 0x11, 0x37, 0x0c, 0x5c, 0xcf, 0x27, 0xcd, 0x69, 0xe9, 0xa5, 0x3e, 0x48, + 0x9a, 0x01, 0xdb, 0x8c, 0x62, 0x83, 0x06, 0x4e, 0x51, 0x44, 0x9f, 0xb1, 0xe0, 0xa4, 0x4a, 0xa0, + 0xa3, 0x1f, 0x84, 0x08, 0xaf, 0xe8, 0x42, 0x41, 0xe9, 0x7a, 0x8c, 0x66, 0x03, 0xed, 0xed, 0x4e, + 0x9c, 0x4c, 0xb7, 0xe1, 0x0c, 0x5f, 0xf4, 0x2a, 0x40, 0xb8, 0xc6, 0xc3, 0x29, 0xa6, 0x13, 0xe1, + 0x22, 0x3d, 0xc8, 0xab, 0x9e, 0xe4, 0xf9, 0x46, 0x92, 0x02, 0x36, 0xa8, 0xa1, 0x6b, 0x00, 0x7c, + 0xda, 0xac, 0xee, 0x74, 0xa4, 0xb5, 0x2d, 0xf3, 0x44, 0x60, 0x45, 0x41, 0xee, 0xee, 0x4e, 0xf4, + 0xba, 0xac, 0xd8, 0xe9, 0xbd, 0xf1, 0x38, 0xfa, 0x09, 0x18, 0x8e, 0xbb, 0xed, 0xb6, 0xa3, 0x1c, + 0xa8, 0x05, 0x66, 0x30, 0x71, 0xba, 0x86, 0x2a, 0xe2, 0x0d, 0x58, 0x72, 0x44, 0xb7, 0xa9, 0x52, + 0x8d, 0x85, 0x2f, 0x8d, 0xcd, 0x22, 0x6e, 0x13, 0x8c, 0xb0, 0x77, 0x7a, 0x9f, 0x8c, 0x0e, 0xc1, + 0x39, 0x38, 0x77, 0x77, 0x27, 0x1e, 0x49, 0xb7, 0x2f, 0x84, 0x22, 0xa7, 0x28, 0x97, 0x26, 0xba, + 0x2a, 0xcb, 0x50, 0xd0, 0xd7, 0x96, 0xd9, 0xd1, 0xcf, 0xe8, 0x32, 0x14, 0xac, 0xb9, 0x7f, 0x9f, + 0x99, 0x0f, 0xa3, 0x45, 0x38, 0xe3, 0x86, 0x41, 0x12, 0x85, 0xbe, 0xcf, 0x6b, 0xab, 0xf0, 0x8d, + 0x0f, 0x77, 0xb0, 0xbe, 0x53, 0x88, 0x7d, 0x66, 0xa6, 0x17, 0x05, 0xe7, 0x3d, 0x67, 0x07, 0xe9, + 0x38, 0x33, 0xd1, 0x39, 0x2f, 0xc0, 0x28, 0xd9, 0x4e, 0x48, 0x14, 0x38, 0xfe, 0x0d, 0xbc, 0x20, + 0x5d, 0x8b, 0x6c, 0x0e, 0x5c, 0x32, 0xda, 0x71, 0x0a, 0x0b, 0xd9, 0x6a, 0xb7, 0x5f, 0xd2, 0x89, + 0x77, 0x7c, 0xb7, 0x2f, 0xf7, 0xf6, 0xf6, 0xff, 0x2a, 0xa5, 0x0c, 0xb2, 0xd5, 0x88, 0x10, 0x14, + 0x42, 0x35, 0x08, 0x9b, 0x4a, 0xf7, 0x5f, 0x2d, 0x46, 0xf7, 0x5f, 0x0f, 0x9b, 0x46, 0xad, 0x0a, + 0xfa, 0x2f, 0xc6, 0x9c, 0x0f, 0x4b, 0xe6, 0x97, 0x55, 0x0f, 0x18, 0x40, 0x6c, 0x34, 0x8a, 0xe4, + 0xac, 0x92, 0xf9, 0x97, 0x4c, 0x46, 0x38, 0xcd, 0x17, 0x6d, 0x42, 0x75, 0x23, 0x8c, 0x13, 0xb9, + 0xfd, 0x38, 0xe2, 0x4e, 0xe7, 0x4a, 0x18, 0x27, 0xcc, 0x8a, 0x50, 0xaf, 0x4d, 0x5b, 0x62, 0xcc, + 0x79, 0xd8, 0xff, 0xc9, 0x4a, 0x39, 0x92, 0x6f, 0xb1, 0x98, 0xcb, 0x2d, 0x12, 0xd0, 0x69, 0x6d, + 0xc6, 0xdb, 0xfc, 0xd9, 0x4c, 0xe2, 0xd7, 0xbb, 0xfa, 0x55, 0x0e, 0xba, 0x43, 0x29, 0x4c, 0x32, + 0x12, 0x46, 0x68, 0xce, 0x27, 0xad, 0x74, 0x0a, 0x5e, 0xa9, 0x88, 0x0d, 0x86, 0x99, 0x62, 0xba, + 0x6f, 0x36, 0x9f, 0xfd, 0x65, 0x0b, 0x86, 0x1b, 0x8e, 0xbb, 0x19, 0xae, 0xaf, 0xa3, 0x67, 0xa1, + 0xd6, 0xec, 0x46, 0x66, 0x36, 0xa0, 0xda, 0x3d, 0xcf, 0x8a, 0x76, 0xac, 0x30, 0xe8, 0x18, 0x5e, + 0x77, 0x5c, 0x99, 0x68, 0x5a, 0xe6, 0x63, 0xf8, 0x32, 0x6b, 0xc1, 0x02, 0x82, 0x5e, 0x84, 0x91, + 0xb6, 0xb3, 0x2d, 0x1f, 0xce, 0x7a, 0xb1, 0x17, 0x35, 0x08, 0x9b, 0x78, 0xf6, 0x3f, 0xb7, 0x60, + 0xbc, 0xe1, 0xc4, 0x9e, 0x3b, 0xdd, 0x4d, 0x36, 0x1a, 0x5e, 0xb2, 0xd6, 0x75, 0x37, 0x49, 0xc2, + 0xb3, 0x8b, 0xa9, 0x94, 0xdd, 0x98, 0x4e, 0x25, 0xb5, 0xaf, 0x53, 0x52, 0xde, 0x10, 0xed, 0x58, + 0x61, 0xa0, 0x37, 0x61, 0xa4, 0xe3, 0xc4, 0xf1, 0x9d, 0x30, 0x6a, 0x62, 0xb2, 0x5e, 0x4c, 0x6e, + 0xff, 0x0a, 0x71, 0x23, 0x92, 0x60, 0xb2, 0x2e, 0x4e, 0x5a, 0x35, 0x7d, 0x6c, 0x32, 0xb3, 0xbf, + 0x60, 0xc1, 0x63, 0x0d, 0xe2, 0x44, 0x24, 0x62, 0xa5, 0x00, 0xd4, 0x8b, 0xcc, 0xf8, 0x61, 0xb7, + 0x89, 0xde, 0x80, 0x5a, 0x42, 0x9b, 0xa9, 0x58, 0x56, 0xb1, 0x62, 0xb1, 0x83, 0xd2, 0x55, 0x41, + 0x1c, 0x2b, 0x36, 0xf6, 0x5f, 0xb1, 0x60, 0x94, 0x9d, 0x39, 0xcd, 0x92, 0xc4, 0xf1, 0xfc, 0x9e, + 0x8a, 0x39, 0xd6, 0x80, 0x15, 0x73, 0x2e, 0x40, 0x65, 0x23, 0x6c, 0x93, 0xec, 0x79, 0xe9, 0x95, + 0x90, 0x6e, 0xab, 0x29, 0x04, 0x3d, 0x4f, 0x3f, 0xbc, 0x17, 0x24, 0x0e, 0x9d, 0x02, 0xd2, 0xa7, + 0x79, 0x8a, 0x7f, 0x74, 0xd5, 0x8c, 0x4d, 0x1c, 0xfb, 0xb7, 0xea, 0x30, 0x2c, 0x0e, 0xd5, 0x07, + 0xce, 0x30, 0x97, 0xfb, 0xfb, 0x52, 0xdf, 0xfd, 0x7d, 0x0c, 0x43, 0x2e, 0xab, 0xc7, 0x25, 0xcc, + 0xc8, 0x6b, 0x85, 0x44, 0x61, 0xf0, 0x12, 0x5f, 0x5a, 0x2c, 0xfe, 0x1f, 0x0b, 0x56, 0xe8, 0x4b, + 0x16, 0x9c, 0x72, 0xc3, 0x20, 0x20, 0xae, 0xb6, 0x71, 0x2a, 0x45, 0x1c, 0xb6, 0xcf, 0xa4, 0x89, + 0xea, 0x03, 0x8f, 0x0c, 0x00, 0x67, 0xd9, 0xa3, 0x97, 0xe1, 0x04, 0xef, 0xb3, 0x9b, 0x29, 0x47, + 0xac, 0x2e, 0xa4, 0x62, 0x02, 0x71, 0x1a, 0x17, 0x4d, 0x72, 0x87, 0xb6, 0x28, 0x59, 0x32, 0xa4, + 0x4f, 0xcf, 0x8c, 0x62, 0x25, 0x06, 0x06, 0x8a, 0x00, 0x45, 0x64, 0x3d, 0x22, 0xf1, 0x86, 0x08, + 0x3a, 0x60, 0xf6, 0xd5, 0xf0, 0xe1, 0x32, 0x56, 0x71, 0x0f, 0x25, 0x9c, 0x43, 0x1d, 0x6d, 0x8a, + 0x0d, 0x66, 0xad, 0x08, 0x1d, 0x2a, 0x3e, 0x73, 0xdf, 0x7d, 0xe6, 0x04, 0x54, 0xe3, 0x0d, 0x27, + 0x6a, 0x32, 0xbb, 0xae, 0xcc, 0xb3, 0x24, 0x56, 0x68, 0x03, 0xe6, 0xed, 0x68, 0x16, 0x4e, 0x67, + 0xca, 0xc0, 0xc4, 0xc2, 0x61, 0xaa, 0x42, 0xfb, 0x33, 0x05, 0x64, 0x62, 0xdc, 0xf3, 0x84, 0xe9, + 0x7c, 0x18, 0xd9, 0xc7, 0xf9, 0xb0, 0xa3, 0x42, 0xdb, 0x46, 0xd9, 0xfa, 0xf8, 0x4a, 0x21, 0x1d, + 0x30, 0x50, 0x1c, 0xdb, 0xe7, 0x33, 0x71, 0x6c, 0x27, 0x98, 0x00, 0x37, 0x8b, 0x11, 0xe0, 0xe0, + 0x41, 0x6b, 0x0f, 0x32, 0x08, 0xed, 0x7f, 0x58, 0x20, 0xbf, 0xeb, 0x8c, 0xe3, 0x6e, 0x10, 0x3a, + 0x64, 0xd0, 0xfb, 0xe1, 0xa4, 0xda, 0x42, 0xcf, 0x84, 0xdd, 0x80, 0xc7, 0x9f, 0x95, 0xf5, 0xc9, + 0x28, 0x4e, 0x41, 0x71, 0x06, 0x1b, 0x4d, 0x41, 0x9d, 0xf6, 0x13, 0x7f, 0x94, 0xaf, 0xb5, 0x6a, + 0x9b, 0x3e, 0xbd, 0x3c, 0x2f, 0x9e, 0xd2, 0x38, 0x28, 0x84, 0x31, 0xdf, 0x89, 0x13, 0x26, 0x01, + 0xdd, 0x51, 0x1f, 0x32, 0x5f, 0x9c, 0xc5, 0x8f, 0x2f, 0x64, 0x09, 0xe1, 0x5e, 0xda, 0xf6, 0xb7, + 0x2b, 0x70, 0x22, 0xa5, 0x19, 0x0f, 0xb8, 0x48, 0x3f, 0x0b, 0x35, 0xb9, 0x6e, 0x66, 0xab, 0x56, + 0xa8, 0xc5, 0x55, 0x61, 0xd0, 0x45, 0x6b, 0x4d, 0xaf, 0xaa, 0x59, 0xa3, 0xc2, 0x58, 0x70, 0xb1, + 0x89, 0xc7, 0x94, 0x72, 0xe2, 0xc7, 0x33, 0xbe, 0x47, 0x82, 0x84, 0x8b, 0x59, 0x8c, 0x52, 0x5e, + 0x5d, 0x58, 0x31, 0x89, 0x6a, 0xa5, 0x9c, 0x01, 0xe0, 0x2c, 0x7b, 0xf4, 0xd3, 0x16, 0x9c, 0x70, + 0xee, 0xc4, 0xba, 0x68, 0xa4, 0x88, 0x58, 0x3b, 0xe2, 0x22, 0x95, 0xaa, 0x43, 0xc9, 0x5d, 0xbe, + 0xa9, 0x26, 0x9c, 0x66, 0x8a, 0xbe, 0x6a, 0x01, 0x22, 0xdb, 0xc4, 0x95, 0x31, 0x75, 0x42, 0x96, + 0xa1, 0x22, 0x76, 0x9a, 0x97, 0x7a, 0xe8, 0x72, 0xad, 0xde, 0xdb, 0x8e, 0x73, 0x64, 0xb0, 0xff, + 0x71, 0x59, 0x4d, 0x28, 0x1d, 0xc6, 0xe9, 0x18, 0xe1, 0x64, 0xd6, 0xe1, 0xc3, 0xc9, 0xf4, 0xb1, + 0x7c, 0x6f, 0x1a, 0x5a, 0x2a, 0xfd, 0xa6, 0xf4, 0x80, 0xd2, 0x6f, 0x7e, 0xca, 0x4a, 0xd5, 0x67, + 0x19, 0xb9, 0xf8, 0x6a, 0xb1, 0x21, 0xa4, 0x93, 0x3c, 0x64, 0x20, 0xa3, 0xdd, 0xd3, 0x91, 0x22, + 0x54, 0x9b, 0x1a, 0x68, 0x07, 0xd2, 0x86, 0xff, 0xae, 0x0c, 0x23, 0xc6, 0x4a, 0x9a, 0x6b, 0x16, + 0x59, 0x0f, 0x99, 0x59, 0x54, 0x3a, 0x80, 0x59, 0xf4, 0x93, 0x50, 0x77, 0xa5, 0x96, 0x2f, 0xa6, + 0x42, 0x69, 0x76, 0xed, 0xd0, 0x8a, 0x5e, 0x35, 0x61, 0xcd, 0x13, 0xcd, 0xa5, 0xf2, 0x57, 0xc4, + 0x0a, 0x51, 0x61, 0x2b, 0x44, 0x5e, 0x82, 0x89, 0x58, 0x29, 0x7a, 0x9f, 0x61, 0x65, 0x7c, 0x3a, + 0x9e, 0x78, 0x2f, 0x19, 0xe8, 0xcd, 0xcb, 0xf8, 0x2c, 0xcf, 0xcb, 0x66, 0x6c, 0xe2, 0xd8, 0xdf, + 0xb6, 0xd4, 0xc7, 0xbd, 0x0f, 0x49, 0xed, 0xb7, 0xd3, 0x49, 0xed, 0x97, 0x0a, 0xe9, 0xe6, 0x3e, + 0xd9, 0xec, 0xd7, 0x61, 0x78, 0x26, 0x6c, 0xb7, 0x9d, 0xa0, 0x89, 0x7e, 0x10, 0x86, 0x5d, 0xfe, + 0x53, 0x38, 0x76, 0xd8, 0xf1, 0xa0, 0x80, 0x62, 0x09, 0x43, 0x8f, 0x43, 0xc5, 0x89, 0x5a, 0xd2, + 0x99, 0xc3, 0x22, 0x4c, 0xa6, 0xa3, 0x56, 0x8c, 0x59, 0xab, 0xfd, 0xf7, 0x2b, 0x00, 0x33, 0x61, + 0xbb, 0xe3, 0x44, 0xa4, 0xb9, 0x1a, 0xb2, 0x0a, 0x69, 0xc7, 0x7a, 0xa8, 0xa6, 0x37, 0x4b, 0x0f, + 0xf3, 0xc1, 0x9a, 0x71, 0xb8, 0x52, 0xbe, 0xcf, 0x87, 0x2b, 0x7d, 0xce, 0xcb, 0x2a, 0x0f, 0xd1, + 0x79, 0x99, 0xfd, 0x39, 0x0b, 0x10, 0x1d, 0x34, 0x61, 0x40, 0x82, 0x44, 0x1f, 0x68, 0x4f, 0x41, + 0xdd, 0x95, 0xad, 0xc2, 0xb0, 0xd2, 0x2a, 0x42, 0x02, 0xb0, 0xc6, 0x19, 0x60, 0x87, 0xfc, 0x94, + 0xd4, 0xdf, 0xe5, 0x74, 0x70, 0x2a, 0xd3, 0xfa, 0x42, 0x9d, 0xdb, 0xbf, 0x5d, 0x82, 0x47, 0xf8, + 0x92, 0xbc, 0xe8, 0x04, 0x4e, 0x8b, 0xb4, 0xa9, 0x54, 0x83, 0x86, 0x28, 0xb8, 0x74, 0x6b, 0xe6, + 0xc9, 0x60, 0xd3, 0xa3, 0xce, 0x5d, 0x3e, 0xe7, 0xf8, 0x2c, 0x9b, 0x0f, 0xbc, 0x04, 0x33, 0xe2, + 0x28, 0x86, 0x9a, 0x2c, 0xc9, 0x2d, 0x74, 0x71, 0x41, 0x8c, 0x94, 0x5a, 0x12, 0xeb, 0x26, 0xc1, + 0x8a, 0x11, 0x35, 0x5c, 0xfd, 0xd0, 0xdd, 0xc4, 0xa4, 0x13, 0x32, 0xbd, 0x6b, 0xc4, 0xfa, 0x2d, + 0x88, 0x76, 0xac, 0x30, 0xec, 0xdf, 0xb6, 0x20, 0xbb, 0x22, 0x19, 0xe5, 0xaa, 0xac, 0x7b, 0x96, + 0xab, 0x3a, 0x40, 0xbd, 0xa8, 0x1f, 0x87, 0x11, 0x27, 0xa1, 0x46, 0x04, 0xdf, 0x76, 0x97, 0x0f, + 0x77, 0xac, 0xb1, 0x18, 0x36, 0xbd, 0x75, 0x8f, 0x6d, 0xb7, 0x4d, 0x72, 0xf6, 0x7f, 0xab, 0xc0, + 0x58, 0x4f, 0x4a, 0x04, 0x7a, 0x09, 0x46, 0x5d, 0x31, 0x3c, 0x3a, 0xd2, 0xa1, 0x55, 0x37, 0x63, + 0xc3, 0x34, 0x0c, 0xa7, 0x30, 0x07, 0x18, 0xa0, 0xf3, 0x70, 0x26, 0xa2, 0x1b, 0xfd, 0x2e, 0x99, + 0x5e, 0x4f, 0x48, 0xb4, 0x42, 0xdc, 0x30, 0x68, 0xf2, 0xa2, 0x6a, 0xe5, 0xc6, 0xa3, 0x7b, 0xbb, + 0x13, 0x67, 0x70, 0x2f, 0x18, 0xe7, 0x3d, 0x83, 0x3a, 0x70, 0xc2, 0x37, 0x6d, 0x40, 0xb1, 0x01, + 0x38, 0x94, 0xf9, 0xa8, 0x6c, 0x84, 0x54, 0x33, 0x4e, 0x33, 0x48, 0x1b, 0x92, 0xd5, 0x07, 0x64, + 0x48, 0x7e, 0x5a, 0x1b, 0x92, 0xfc, 0xfc, 0xfd, 0xc3, 0x05, 0xa7, 0xc4, 0x1c, 0xb7, 0x25, 0xf9, + 0x0a, 0xd4, 0x64, 0x6c, 0xd2, 0x40, 0x31, 0x3d, 0x26, 0x9d, 0x3e, 0x1a, 0xed, 0x6e, 0x09, 0x72, + 0x36, 0x21, 0x74, 0x9e, 0xe9, 0x15, 0x3f, 0x35, 0xcf, 0x0e, 0xb6, 0xea, 0xa3, 0x6d, 0x1e, 0x97, + 0xc5, 0xd7, 0xb6, 0x0f, 0x15, 0xbd, 0x89, 0xd2, 0xa1, 0x5a, 0x2a, 0x53, 0x40, 0x85, 0x6b, 0x5d, + 0x04, 0xd0, 0x86, 0x9a, 0x88, 0x03, 0x57, 0xc7, 0xbe, 0xda, 0x9e, 0xc3, 0x06, 0x16, 0xdd, 0x53, + 0x7b, 0x41, 0x9c, 0x38, 0xbe, 0x7f, 0xc5, 0x0b, 0x12, 0xe1, 0x1c, 0x54, 0x8b, 0xf8, 0xbc, 0x06, + 0x61, 0x13, 0xef, 0xfc, 0xfb, 0x8c, 0xef, 0x72, 0x90, 0xef, 0xb9, 0x01, 0x8f, 0xcd, 0x79, 0x89, + 0xca, 0x5e, 0x50, 0xe3, 0x88, 0xda, 0x61, 0x2a, 0x1b, 0xc7, 0xea, 0x9b, 0x8d, 0x63, 0x64, 0x0f, + 0x94, 0xd2, 0xc9, 0x0e, 0xd9, 0xec, 0x01, 0xfb, 0x25, 0x38, 0x3b, 0xe7, 0x25, 0x97, 0x3d, 0x9f, + 0x1c, 0x90, 0x89, 0xfd, 0x9b, 0x43, 0x30, 0x6a, 0xe6, 0xbf, 0x1d, 0x24, 0xa1, 0xe8, 0x0b, 0xd4, + 0xd4, 0x12, 0x6f, 0xe7, 0xa9, 0x43, 0xb3, 0x5b, 0x47, 0x4e, 0xc6, 0xcb, 0xef, 0x31, 0xc3, 0xda, + 0xd2, 0x3c, 0xb1, 0x29, 0x00, 0xba, 0x03, 0xd5, 0x75, 0x16, 0xdd, 0x5e, 0x2e, 0x22, 0xb2, 0x20, + 0xaf, 0x47, 0xf5, 0x34, 0xe3, 0xf1, 0xf1, 0x9c, 0x1f, 0x5d, 0x21, 0xa3, 0x74, 0xca, 0x94, 0x11, + 0x91, 0x29, 0x92, 0xa5, 0x14, 0x46, 0x3f, 0x55, 0x5f, 0x3d, 0x84, 0xaa, 0x4f, 0x29, 0xde, 0xa1, + 0x07, 0xa4, 0x78, 0x59, 0xa6, 0x42, 0xb2, 0xc1, 0xec, 0x37, 0x11, 0x42, 0x3e, 0xcc, 0x3a, 0xc1, + 0xc8, 0x54, 0x48, 0x81, 0x71, 0x16, 0x1f, 0x7d, 0x42, 0xa9, 0xee, 0x5a, 0x11, 0x7e, 0x55, 0x73, + 0x44, 0x1f, 0xb7, 0xd6, 0xfe, 0x5c, 0x09, 0x4e, 0xce, 0x05, 0xdd, 0xe5, 0xb9, 0xe5, 0xee, 0x9a, + 0xef, 0xb9, 0xd7, 0xc8, 0x0e, 0x55, 0xcd, 0x9b, 0x64, 0x67, 0x7e, 0x56, 0xcc, 0x20, 0x35, 0x66, + 0xae, 0xd1, 0x46, 0xcc, 0x61, 0x54, 0x19, 0xad, 0x7b, 0x41, 0x8b, 0x44, 0x9d, 0xc8, 0x13, 0x2e, + 0x4f, 0x43, 0x19, 0x5d, 0xd6, 0x20, 0x6c, 0xe2, 0x51, 0xda, 0xe1, 0x9d, 0x80, 0x44, 0x59, 0x43, + 0x76, 0x89, 0x36, 0x62, 0x0e, 0xa3, 0x48, 0x49, 0xd4, 0x8d, 0x13, 0x31, 0x18, 0x15, 0xd2, 0x2a, + 0x6d, 0xc4, 0x1c, 0x46, 0x67, 0x7a, 0xdc, 0x5d, 0x63, 0x81, 0x1b, 0x99, 0x78, 0xf5, 0x15, 0xde, + 0x8c, 0x25, 0x9c, 0xa2, 0x6e, 0x92, 0x9d, 0x59, 0xba, 0xeb, 0xcd, 0xa4, 0xad, 0x5c, 0xe3, 0xcd, + 0x58, 0xc2, 0x59, 0x35, 0xb8, 0x74, 0x77, 0x7c, 0xcf, 0x55, 0x83, 0x4b, 0x8b, 0xdf, 0x67, 0xff, + 0xfc, 0xcb, 0x16, 0x8c, 0x9a, 0xe1, 0x56, 0xa8, 0x95, 0xb1, 0x71, 0x97, 0x7a, 0x8a, 0x89, 0xfe, + 0x68, 0xde, 0xcd, 0x49, 0x2d, 0x2f, 0x09, 0x3b, 0xf1, 0x73, 0x24, 0x68, 0x79, 0x01, 0x61, 0xa7, + 0xe8, 0x3c, 0x4c, 0x2b, 0x15, 0xcb, 0x35, 0x13, 0x36, 0xc9, 0x21, 0x8c, 0x64, 0xfb, 0x16, 0x8c, + 0xf5, 0xe4, 0x2a, 0x0d, 0x60, 0x5a, 0xec, 0x9b, 0x29, 0x6a, 0x63, 0x18, 0xa1, 0x84, 0x65, 0x69, + 0x95, 0x19, 0x18, 0xe3, 0x13, 0x89, 0x72, 0x5a, 0x71, 0x37, 0x48, 0x5b, 0xe5, 0x9f, 0x31, 0xff, + 0xfa, 0xcd, 0x2c, 0x10, 0xf7, 0xe2, 0xdb, 0x9f, 0xb7, 0xe0, 0x44, 0x2a, 0x7d, 0xac, 0x20, 0x23, + 0x88, 0xcd, 0xb4, 0x90, 0x45, 0xff, 0xb1, 0x10, 0xe8, 0x32, 0x5b, 0x4c, 0xf5, 0x4c, 0xd3, 0x20, + 0x6c, 0xe2, 0xd9, 0x5f, 0x2e, 0x41, 0x4d, 0x46, 0x50, 0x0c, 0x20, 0xca, 0x67, 0x2d, 0x38, 0xa1, + 0xce, 0x34, 0x98, 0xb3, 0xac, 0x54, 0x44, 0xac, 0x3f, 0x95, 0x40, 0x6d, 0xb7, 0x83, 0xf5, 0x50, + 0x5b, 0xe4, 0xd8, 0x64, 0x86, 0xd3, 0xbc, 0xd1, 0x4d, 0x80, 0x78, 0x27, 0x4e, 0x48, 0xdb, 0x70, + 0xdb, 0xd9, 0xc6, 0x8c, 0x9b, 0x74, 0xc3, 0x88, 0xd0, 0xf9, 0x75, 0x3d, 0x6c, 0x92, 0x15, 0x85, + 0xa9, 0x4d, 0x28, 0xdd, 0x86, 0x0d, 0x4a, 0xf6, 0xdf, 0x2d, 0xc1, 0xe9, 0xac, 0x48, 0xe8, 0xc3, + 0x30, 0x2a, 0xb9, 0x1b, 0xb7, 0x40, 0xc9, 0xb0, 0x91, 0x51, 0x6c, 0xc0, 0xee, 0xee, 0x4e, 0x4c, + 0xf4, 0xde, 0xc2, 0x35, 0x69, 0xa2, 0xe0, 0x14, 0x31, 0x7e, 0xb0, 0x24, 0x4e, 0x40, 0x1b, 0x3b, + 0xd3, 0x9d, 0x8e, 0x38, 0x1d, 0x32, 0x0e, 0x96, 0x4c, 0x28, 0xce, 0x60, 0xa3, 0x65, 0x38, 0x6b, + 0xb4, 0x5c, 0x27, 0x5e, 0x6b, 0x63, 0x2d, 0x8c, 0xe4, 0xce, 0xea, 0x71, 0x1d, 0xd8, 0xd5, 0x8b, + 0x83, 0x73, 0x9f, 0xa4, 0xab, 0xbd, 0xeb, 0x74, 0x1c, 0xd7, 0x4b, 0x76, 0x84, 0x1f, 0x52, 0xe9, + 0xa6, 0x19, 0xd1, 0x8e, 0x15, 0x86, 0xbd, 0x08, 0x95, 0x01, 0x47, 0xd0, 0x40, 0x16, 0xfd, 0x2b, + 0x50, 0xa3, 0xe4, 0xa4, 0x79, 0x57, 0x04, 0xc9, 0x10, 0x6a, 0xf2, 0x22, 0x07, 0x64, 0x43, 0xd9, + 0x73, 0xe4, 0xd9, 0x9d, 0x7a, 0xad, 0xf9, 0x38, 0xee, 0xb2, 0x4d, 0x32, 0x05, 0xa2, 0xa7, 0xa0, + 0x4c, 0xb6, 0x3b, 0xd9, 0x43, 0xba, 0x4b, 0xdb, 0x1d, 0x2f, 0x22, 0x31, 0x45, 0x22, 0xdb, 0x1d, + 0x74, 0x1e, 0x4a, 0x5e, 0x53, 0x2c, 0x52, 0x20, 0x70, 0x4a, 0xf3, 0xb3, 0xb8, 0xe4, 0x35, 0xed, + 0x6d, 0xa8, 0xab, 0x9b, 0x23, 0xd0, 0xa6, 0xd4, 0xdd, 0x56, 0x11, 0x21, 0x4f, 0x92, 0x6e, 0x1f, + 0xad, 0xdd, 0x05, 0xd0, 0x79, 0x74, 0x45, 0xe9, 0x97, 0x0b, 0x50, 0x71, 0x43, 0x91, 0xe3, 0x5b, + 0xd3, 0x64, 0x98, 0xd2, 0x66, 0x10, 0xfb, 0x16, 0x9c, 0xbc, 0x16, 0x84, 0x77, 0x58, 0x69, 0x6c, + 0x56, 0xd2, 0x8a, 0x12, 0x5e, 0xa7, 0x3f, 0xb2, 0x26, 0x02, 0x83, 0x62, 0x0e, 0x53, 0x65, 0x8f, + 0x4a, 0xfd, 0xca, 0x1e, 0xd9, 0x9f, 0xb4, 0xe0, 0xb4, 0xca, 0x06, 0x92, 0xda, 0xf8, 0x25, 0x18, + 0x5d, 0xeb, 0x7a, 0x7e, 0x53, 0x16, 0xca, 0xca, 0xb8, 0x29, 0x1a, 0x06, 0x0c, 0xa7, 0x30, 0xe9, + 0xa6, 0x6a, 0xcd, 0x0b, 0x9c, 0x68, 0x67, 0x59, 0xab, 0x7f, 0xa5, 0x11, 0x1a, 0x0a, 0x82, 0x0d, + 0x2c, 0xfb, 0xb3, 0xa6, 0x08, 0x22, 0xff, 0x68, 0x80, 0x9e, 0xbd, 0x01, 0x55, 0x57, 0x9d, 0xf5, + 0x1e, 0xaa, 0x98, 0x9f, 0xca, 0x2f, 0x67, 0xfe, 0x7e, 0x4e, 0xcd, 0xfe, 0x27, 0x25, 0x38, 0x91, + 0xaa, 0x59, 0x82, 0x7c, 0xa8, 0x11, 0x9f, 0xb9, 0xf2, 0xe4, 0x10, 0x3b, 0x6a, 0xb9, 0x48, 0x35, + 0x2d, 0x2e, 0x09, 0xba, 0x58, 0x71, 0x78, 0x38, 0x8e, 0xd4, 0x5e, 0x82, 0x51, 0x29, 0xd0, 0x87, + 0x9c, 0xb6, 0x2f, 0x66, 0xa1, 0x1a, 0x00, 0x97, 0x0c, 0x18, 0x4e, 0x61, 0xda, 0xff, 0xac, 0x0c, + 0xe3, 0xdc, 0xf7, 0xd9, 0x54, 0x51, 0x2f, 0x8b, 0xd2, 0xca, 0xfa, 0x0b, 0xba, 0xb2, 0x10, 0xef, + 0xc8, 0xb5, 0xa3, 0x56, 0x67, 0xce, 0x67, 0x34, 0x50, 0x3c, 0xc6, 0x2f, 0x66, 0xe2, 0x31, 0xf8, + 0x62, 0xdb, 0x3a, 0x26, 0x89, 0xbe, 0xb7, 0x02, 0x34, 0xfe, 0x56, 0x09, 0x4e, 0x65, 0x4a, 0x5f, + 0xa3, 0x2f, 0xa6, 0xcb, 0x3e, 0x5a, 0x45, 0x78, 0xc8, 0xee, 0x59, 0x0d, 0xf9, 0x60, 0xc5, 0x1f, + 0x1f, 0xd0, 0x54, 0xb1, 0x7f, 0xb7, 0x04, 0x27, 0xd3, 0x35, 0xbb, 0x1f, 0xc2, 0x9e, 0x7a, 0x0f, + 0xd4, 0x59, 0x59, 0x5a, 0x76, 0xcf, 0x18, 0x77, 0xc4, 0xf1, 0x52, 0xa6, 0xb2, 0x11, 0x6b, 0xf8, + 0x43, 0x51, 0x53, 0xd3, 0xfe, 0xdb, 0x16, 0x9c, 0xe3, 0x6f, 0x99, 0x1d, 0x87, 0x7f, 0x31, 0xaf, + 0x77, 0x5f, 0x2b, 0x56, 0xc0, 0x4c, 0x45, 0xac, 0xfd, 0xfa, 0x97, 0xdd, 0x6f, 0x24, 0xa4, 0x4d, + 0x0f, 0x85, 0x87, 0x50, 0xd8, 0x03, 0x0d, 0x06, 0xfb, 0x77, 0xcb, 0xa0, 0xaf, 0x74, 0x42, 0x9e, + 0xc8, 0x6c, 0x2a, 0xa4, 0x32, 0xd8, 0xca, 0x4e, 0xe0, 0xea, 0xcb, 0xa3, 0x6a, 0x99, 0xc4, 0xa6, + 0x9f, 0xb3, 0x60, 0xc4, 0x0b, 0xbc, 0xc4, 0x73, 0x98, 0xf1, 0x5c, 0xcc, 0x95, 0x34, 0x8a, 0xdd, + 0x3c, 0xa7, 0x1c, 0x46, 0xa6, 0xf7, 0x56, 0x31, 0xc3, 0x26, 0x67, 0xf4, 0x51, 0x11, 0x32, 0x59, + 0x2e, 0x2c, 0x27, 0xaf, 0x96, 0x89, 0x93, 0xec, 0x40, 0x35, 0x22, 0x49, 0x54, 0x50, 0x2a, 0x2b, + 0xa6, 0xa4, 0x54, 0x91, 0x49, 0x7d, 0xb9, 0x26, 0x6d, 0xc6, 0x9c, 0x91, 0x1d, 0x03, 0xea, 0xed, + 0x8b, 0x03, 0x86, 0xa3, 0x4d, 0x41, 0xdd, 0xe9, 0x26, 0x61, 0x9b, 0x76, 0x93, 0x70, 0x30, 0xeb, + 0x80, 0x3b, 0x09, 0xc0, 0x1a, 0xc7, 0xfe, 0x62, 0x15, 0x32, 0xa9, 0x46, 0x68, 0xdb, 0xbc, 0x8e, + 0xcc, 0x2a, 0xf6, 0x3a, 0x32, 0x25, 0x4c, 0xde, 0x95, 0x64, 0xa8, 0x05, 0xd5, 0xce, 0x86, 0x13, + 0x4b, 0xdb, 0xf8, 0x15, 0xd9, 0x4d, 0xcb, 0xb4, 0xf1, 0xee, 0xee, 0xc4, 0x8f, 0x0d, 0xe6, 0x6b, + 0xa1, 0x63, 0x75, 0x8a, 0x67, 0xee, 0x6b, 0xd6, 0x8c, 0x06, 0xe6, 0xf4, 0x0f, 0x72, 0x29, 0xcf, + 0xa7, 0x44, 0x21, 0x61, 0x4c, 0xe2, 0xae, 0x9f, 0x88, 0xd1, 0xf0, 0x4a, 0x81, 0xb3, 0x8c, 0x13, + 0xd6, 0x49, 0xb2, 0xfc, 0x3f, 0x36, 0x98, 0xa2, 0x0f, 0x43, 0x3d, 0x4e, 0x9c, 0x28, 0x39, 0x64, + 0x5a, 0x9b, 0xea, 0xf4, 0x15, 0x49, 0x04, 0x6b, 0x7a, 0xe8, 0x55, 0x56, 0x28, 0xd1, 0x8b, 0x37, + 0x0e, 0x19, 0xe9, 0x2c, 0x8b, 0x2a, 0x0a, 0x0a, 0xd8, 0xa0, 0x46, 0xb7, 0x1e, 0x6c, 0x6c, 0xf3, + 0xf0, 0x9e, 0x1a, 0xdb, 0x5b, 0x2a, 0x55, 0x88, 0x15, 0x04, 0x1b, 0x58, 0xf6, 0x0f, 0x41, 0x3a, + 0xcb, 0x1b, 0x4d, 0xc8, 0xa4, 0x72, 0xee, 0x7b, 0x62, 0x11, 0xcb, 0xa9, 0xfc, 0xef, 0x5f, 0xb7, + 0xc0, 0x4c, 0x45, 0x47, 0x6f, 0xf0, 0x9c, 0x77, 0xab, 0x88, 0xf3, 0x02, 0x83, 0xee, 0xe4, 0xa2, + 0xd3, 0xc9, 0x1c, 0x5c, 0xc9, 0xc4, 0xf7, 0xf3, 0xef, 0x83, 0x9a, 0x84, 0x1e, 0xc8, 0xa8, 0xfb, + 0x04, 0x9c, 0xc9, 0x5e, 0xd6, 0x2a, 0x7c, 0xcd, 0xad, 0x28, 0xec, 0x76, 0xb2, 0x1b, 0x49, 0x76, + 0x99, 0x27, 0xe6, 0x30, 0xba, 0x1d, 0xdb, 0xf4, 0x82, 0x66, 0x76, 0x23, 0x79, 0xcd, 0x0b, 0x9a, + 0x98, 0x41, 0x06, 0xb8, 0x94, 0xee, 0x37, 0x2c, 0xb8, 0xb0, 0xdf, 0x9d, 0xb2, 0xe8, 0x71, 0xa8, + 0xdc, 0x71, 0x22, 0x59, 0xc1, 0x96, 0x29, 0xca, 0x5b, 0x4e, 0x14, 0x60, 0xd6, 0x8a, 0x76, 0x60, + 0x88, 0xc7, 0x80, 0x08, 0x6b, 0xfd, 0x95, 0x62, 0x6f, 0xb8, 0xbd, 0x46, 0x8c, 0xed, 0x02, 0x8f, + 0x3f, 0xc1, 0x82, 0xa1, 0xfd, 0x1d, 0x0b, 0xd0, 0xd2, 0x16, 0x89, 0x22, 0xaf, 0x69, 0x44, 0xad, + 0xa0, 0x17, 0x60, 0xf4, 0xf6, 0xca, 0xd2, 0xf5, 0xe5, 0xd0, 0x0b, 0x58, 0xd5, 0x07, 0x23, 0xb1, + 0xed, 0xaa, 0xd1, 0x8e, 0x53, 0x58, 0x68, 0x06, 0xc6, 0x6e, 0xbf, 0x41, 0x37, 0xbf, 0x66, 0xb5, + 0xfc, 0x92, 0x76, 0x77, 0x5e, 0x7d, 0x25, 0x03, 0xc4, 0xbd, 0xf8, 0x68, 0x09, 0xce, 0xb5, 0xf9, + 0x76, 0x83, 0x17, 0xb9, 0xe6, 0x7b, 0x0f, 0x95, 0x46, 0xf2, 0xd8, 0xde, 0xee, 0xc4, 0xb9, 0xc5, + 0x3c, 0x04, 0x9c, 0xff, 0x9c, 0xfd, 0x3e, 0x40, 0x3c, 0x58, 0x65, 0x26, 0x2f, 0xf2, 0xa0, 0xef, + 0x4e, 0xdc, 0xfe, 0x5a, 0x15, 0x4e, 0x65, 0xea, 0x1b, 0xd2, 0xad, 0x5e, 0x6f, 0xa8, 0xc3, 0x91, + 0xd7, 0xef, 0x5e, 0xf1, 0x06, 0x0a, 0x9e, 0x08, 0xa0, 0xea, 0x05, 0x9d, 0x6e, 0x52, 0x4c, 0xe6, + 0x18, 0x17, 0x62, 0x9e, 0x12, 0x34, 0x9c, 0x44, 0xf4, 0x2f, 0xe6, 0x6c, 0x8a, 0x0c, 0xc5, 0x48, + 0x19, 0xe3, 0x95, 0x07, 0xe4, 0x0e, 0xf8, 0x94, 0x0e, 0x8c, 0xa8, 0x16, 0x71, 0x50, 0x9f, 0x19, + 0x2c, 0xc7, 0x7d, 0xc0, 0xf6, 0x6b, 0x25, 0x18, 0x31, 0x3e, 0x1a, 0xfa, 0xa5, 0x74, 0xa1, 0x16, + 0xab, 0xb8, 0x57, 0x62, 0xf4, 0x27, 0x75, 0x29, 0x16, 0xfe, 0x4a, 0x4f, 0xf7, 0xd6, 0x68, 0xb9, + 0xbb, 0x3b, 0x71, 0x3a, 0x53, 0x85, 0x25, 0x55, 0xb7, 0xe5, 0xfc, 0xc7, 0xe1, 0x54, 0x86, 0x4c, + 0xce, 0x2b, 0xaf, 0xa6, 0xef, 0xe2, 0x3d, 0xa2, 0x5b, 0xca, 0xec, 0xb2, 0xb7, 0x68, 0x97, 0xe9, + 0x2b, 0xda, 0x07, 0x70, 0xc7, 0x65, 0x72, 0xe4, 0x4a, 0x03, 0xe6, 0xc8, 0x3d, 0x03, 0xb5, 0x4e, + 0xe8, 0x7b, 0xae, 0xa7, 0x4a, 0x7a, 0xb1, 0xac, 0xbc, 0x65, 0xd1, 0x86, 0x15, 0x14, 0xdd, 0x81, + 0xba, 0xba, 0xb6, 0x58, 0x04, 0x21, 0x16, 0xe5, 0xea, 0x55, 0x46, 0x8b, 0xbe, 0x8e, 0x58, 0xf3, + 0x42, 0x36, 0x0c, 0xb1, 0x45, 0x50, 0x06, 0xfc, 0xb2, 0x0c, 0x4e, 0xb6, 0x3a, 0xc6, 0x58, 0x40, + 0xec, 0x6f, 0xd4, 0xe1, 0x6c, 0x5e, 0x91, 0x59, 0xf4, 0x31, 0x18, 0xe2, 0x32, 0x16, 0x53, 0xc7, + 0x3c, 0x8f, 0xc7, 0x1c, 0x23, 0x28, 0xc4, 0x62, 0xbf, 0xb1, 0xe0, 0x29, 0xb8, 0xfb, 0xce, 0x9a, + 0x18, 0x21, 0xc7, 0xc3, 0x7d, 0xc1, 0xd1, 0xdc, 0x17, 0x1c, 0xce, 0xdd, 0x77, 0xd6, 0xd0, 0x36, + 0x54, 0x5b, 0x5e, 0x42, 0x1c, 0xe1, 0x44, 0xb8, 0x75, 0x2c, 0xcc, 0x89, 0xc3, 0xad, 0x34, 0xf6, + 0x13, 0x73, 0x86, 0xe8, 0xeb, 0x16, 0x9c, 0x5a, 0x4b, 0x27, 0xc4, 0x0a, 0xe5, 0xe9, 0x1c, 0x43, + 0x21, 0xe1, 0x34, 0x23, 0x7e, 0x23, 0x45, 0xa6, 0x11, 0x67, 0xc5, 0x41, 0x9f, 0xb6, 0x60, 0x78, + 0xdd, 0xf3, 0x8d, 0x9a, 0x92, 0xc7, 0xf0, 0x71, 0x2e, 0x33, 0x06, 0x7a, 0xc7, 0xc1, 0xff, 0xc7, + 0x58, 0x72, 0xee, 0xb7, 0x52, 0x0d, 0x1d, 0x75, 0xa5, 0x1a, 0x7e, 0x40, 0x2b, 0xd5, 0x67, 0x2c, + 0xa8, 0xab, 0x9e, 0x16, 0x49, 0x8e, 0x1f, 0x3e, 0xc6, 0x4f, 0xce, 0x3d, 0x27, 0xea, 0x2f, 0xd6, + 0xcc, 0xd1, 0x97, 0x2c, 0x18, 0x71, 0xde, 0xec, 0x46, 0xa4, 0x49, 0xb6, 0xc2, 0x4e, 0x2c, 0x6e, + 0x81, 0x7a, 0xad, 0x78, 0x61, 0xa6, 0x29, 0x93, 0x59, 0xb2, 0xb5, 0xd4, 0x89, 0x45, 0x32, 0x82, + 0x6e, 0xc0, 0xa6, 0x08, 0xf6, 0x6e, 0x09, 0x26, 0xf6, 0xa1, 0x80, 0x5e, 0x82, 0xd1, 0x30, 0x6a, + 0x39, 0x81, 0xf7, 0xa6, 0x99, 0xe1, 0xae, 0xac, 0xac, 0x25, 0x03, 0x86, 0x53, 0x98, 0x66, 0x1a, + 0x66, 0x69, 0x9f, 0x34, 0xcc, 0x0b, 0x50, 0x89, 0x48, 0x27, 0xcc, 0x6e, 0x16, 0x58, 0x20, 0x30, + 0x83, 0xa0, 0x27, 0xa0, 0xec, 0x74, 0x3c, 0x11, 0x7e, 0xa2, 0xf6, 0x40, 0xd3, 0xcb, 0xf3, 0x98, + 0xb6, 0xa7, 0xb2, 0xc2, 0xab, 0xf7, 0x25, 0x2b, 0x9c, 0x2e, 0x03, 0xe2, 0xec, 0x62, 0x48, 0x2f, + 0x03, 0xe9, 0x33, 0x05, 0xfb, 0xab, 0x65, 0x78, 0xe2, 0x9e, 0xe3, 0x45, 0x47, 0xdf, 0x58, 0xf7, + 0x88, 0xbe, 0x91, 0xdd, 0x53, 0xda, 0xaf, 0x7b, 0xca, 0x7d, 0xba, 0xe7, 0xd3, 0x74, 0x1a, 0xc8, + 0xca, 0x00, 0xc5, 0x5c, 0x48, 0xd4, 0xaf, 0xd0, 0x80, 0x98, 0x01, 0x12, 0x8a, 0x35, 0x5f, 0xba, + 0x07, 0x48, 0xa5, 0x20, 0x56, 0x8b, 0x58, 0x06, 0xfa, 0x56, 0x0a, 0xe0, 0x63, 0xbf, 0x5f, 0x5e, + 0xa3, 0xfd, 0xf3, 0x25, 0x78, 0x6a, 0x00, 0xed, 0x6d, 0x8e, 0x62, 0x6b, 0xc0, 0x51, 0xfc, 0xbd, + 0xfd, 0x99, 0xec, 0xbf, 0x64, 0xc1, 0xf9, 0xfe, 0x8b, 0x07, 0x7a, 0x1e, 0x46, 0xd6, 0x22, 0x27, + 0x70, 0x37, 0xd8, 0x25, 0x6b, 0xb2, 0x53, 0x58, 0x5f, 0xeb, 0x66, 0x6c, 0xe2, 0xd0, 0xed, 0x2d, + 0x2f, 0xec, 0x6e, 0x60, 0xc8, 0x94, 0x31, 0xba, 0xbd, 0x5d, 0xcd, 0x02, 0x71, 0x2f, 0xbe, 0xfd, + 0x27, 0xa5, 0x7c, 0xb1, 0xb8, 0x91, 0x71, 0x90, 0xef, 0x24, 0xbe, 0x42, 0x69, 0x00, 0x5d, 0x52, + 0xbe, 0xdf, 0xba, 0xa4, 0xd2, 0x4f, 0x97, 0xa0, 0x59, 0x38, 0x6d, 0xdc, 0x47, 0xc0, 0xd3, 0x00, + 0x79, 0x98, 0x9d, 0xca, 0x8d, 0x5f, 0xce, 0xc0, 0x71, 0xcf, 0x13, 0xe8, 0x59, 0xa8, 0x79, 0x41, + 0x4c, 0xdc, 0x6e, 0xc4, 0xc3, 0x3b, 0x8d, 0xd4, 0x8b, 0x79, 0xd1, 0x8e, 0x15, 0x86, 0xfd, 0xcb, + 0x25, 0x78, 0xac, 0xaf, 0x9d, 0x75, 0x9f, 0x74, 0x97, 0xf9, 0x39, 0x2a, 0xf7, 0xe7, 0x73, 0x98, + 0x9d, 0x54, 0xdd, 0xb7, 0x93, 0x7e, 0xaf, 0xff, 0xc0, 0xa4, 0x36, 0xf7, 0xf7, 0x6d, 0x2f, 0xbd, + 0x0c, 0x27, 0x9c, 0x4e, 0x87, 0xe3, 0xb1, 0x28, 0xad, 0x4c, 0x6d, 0x8c, 0x69, 0x13, 0x88, 0xd3, + 0xb8, 0x03, 0xad, 0x9e, 0x7f, 0x68, 0x41, 0x1d, 0x93, 0x75, 0xae, 0x1d, 0xd0, 0x6d, 0xd1, 0x45, + 0x56, 0x11, 0x55, 0xf4, 0x68, 0xc7, 0xc6, 0x1e, 0xab, 0x2e, 0x97, 0xd7, 0xd9, 0xbd, 0xf7, 0x56, + 0x94, 0x0e, 0x74, 0x6f, 0x85, 0xba, 0xb9, 0xa0, 0xdc, 0xff, 0xe6, 0x02, 0xfb, 0xad, 0x61, 0xfa, + 0x7a, 0x9d, 0x70, 0x26, 0x22, 0xcd, 0x98, 0x7e, 0xdf, 0x6e, 0xe4, 0x8b, 0x41, 0xa2, 0xbe, 0xef, + 0x0d, 0xbc, 0x80, 0x69, 0x7b, 0xea, 0x28, 0xa6, 0x74, 0xa0, 0xca, 0x00, 0xe5, 0x7d, 0x2b, 0x03, + 0xbc, 0x0c, 0x27, 0xe2, 0x78, 0x63, 0x39, 0xf2, 0xb6, 0x9c, 0x84, 0x5c, 0x23, 0x3b, 0xc2, 0xca, + 0xd2, 0xd9, 0xbc, 0x2b, 0x57, 0x34, 0x10, 0xa7, 0x71, 0xd1, 0x1c, 0x8c, 0xe9, 0xfc, 0x7c, 0x12, + 0x25, 0x2c, 0xa6, 0x97, 0x8f, 0x04, 0x95, 0xba, 0xa7, 0x33, 0xfa, 0x05, 0x02, 0xee, 0x7d, 0x86, + 0xea, 0xb7, 0x54, 0x23, 0x15, 0x64, 0x28, 0xad, 0xdf, 0x52, 0x74, 0xa8, 0x2c, 0x3d, 0x4f, 0xa0, + 0x45, 0x38, 0xc3, 0x07, 0xc6, 0x74, 0xa7, 0x63, 0xbc, 0xd1, 0x70, 0xba, 0x7a, 0xd9, 0x5c, 0x2f, + 0x0a, 0xce, 0x7b, 0x0e, 0xbd, 0x08, 0x23, 0xaa, 0x79, 0x7e, 0x56, 0x9c, 0x22, 0x28, 0x2f, 0x86, + 0x22, 0x33, 0xdf, 0xc4, 0x26, 0x1e, 0xfa, 0x10, 0x3c, 0xaa, 0xff, 0xf2, 0xc4, 0x0f, 0x7e, 0xb4, + 0x36, 0x2b, 0x4a, 0x9f, 0xa8, 0x3a, 0xf9, 0x73, 0xb9, 0x68, 0x4d, 0xdc, 0xef, 0x79, 0xb4, 0x06, + 0xe7, 0x15, 0xe8, 0x52, 0x90, 0xb0, 0x28, 0xee, 0x98, 0x34, 0x9c, 0x98, 0xdc, 0x88, 0x7c, 0x56, + 0x2c, 0xa5, 0xae, 0xaf, 0x30, 0x9b, 0xf3, 0x92, 0x2b, 0x79, 0x98, 0x78, 0x01, 0xdf, 0x83, 0x0a, + 0x9a, 0x82, 0x3a, 0x09, 0x9c, 0x35, 0x9f, 0x2c, 0xcd, 0xcc, 0xb3, 0x12, 0x2a, 0xc6, 0x49, 0xde, + 0x25, 0x09, 0xc0, 0x1a, 0x47, 0xc5, 0x95, 0x8d, 0xf6, 0xbd, 0x4e, 0x6f, 0x19, 0xce, 0xb6, 0xdc, + 0x0e, 0xb5, 0x3d, 0x3c, 0x97, 0x4c, 0xbb, 0x2c, 0xb6, 0x8a, 0x7e, 0x18, 0x5e, 0x56, 0x4e, 0x05, + 0x4d, 0xce, 0xcd, 0x2c, 0xf7, 0xe0, 0xe0, 0xdc, 0x27, 0xe9, 0x1c, 0xeb, 0x44, 0xe1, 0xf6, 0xce, + 0xf8, 0x99, 0xf4, 0x1c, 0x5b, 0xa6, 0x8d, 0x98, 0xc3, 0xd0, 0x55, 0x40, 0x2c, 0x02, 0xf7, 0x4a, + 0x92, 0x74, 0x94, 0xb1, 0x33, 0x7e, 0x96, 0xbd, 0xd2, 0x79, 0xf1, 0x04, 0xba, 0xdc, 0x83, 0x81, + 0x73, 0x9e, 0xb2, 0xff, 0xc0, 0x82, 0x13, 0x6a, 0xbe, 0xde, 0x87, 0x18, 0x74, 0x3f, 0x1d, 0x83, + 0x3e, 0x77, 0x74, 0x8d, 0xc7, 0x24, 0xef, 0x13, 0xc8, 0xf8, 0x33, 0x23, 0x00, 0x5a, 0x2b, 0xaa, + 0x05, 0xc9, 0xea, 0xbb, 0x20, 0x3d, 0xb4, 0x1a, 0x29, 0xaf, 0x5e, 0x42, 0xf5, 0xc1, 0xd6, 0x4b, + 0x58, 0x81, 0x73, 0xd2, 0x5c, 0xe0, 0x67, 0x45, 0x57, 0xc2, 0x58, 0x29, 0xb8, 0x5a, 0xe3, 0x09, + 0x41, 0xe8, 0xdc, 0x7c, 0x1e, 0x12, 0xce, 0x7f, 0x36, 0x65, 0xa5, 0x0c, 0xef, 0x67, 0xa5, 0xe8, + 0x39, 0xbd, 0xb0, 0x2e, 0x0b, 0xe2, 0x67, 0xe6, 0xf4, 0xc2, 0xe5, 0x15, 0xac, 0x71, 0xf2, 0x15, + 0x7b, 0xbd, 0x20, 0xc5, 0x0e, 0x07, 0x56, 0xec, 0x52, 0xc5, 0x8c, 0xf4, 0x55, 0x31, 0xd2, 0x27, + 0x3d, 0xda, 0xd7, 0x27, 0xfd, 0x7e, 0x38, 0xe9, 0x05, 0x1b, 0x24, 0xf2, 0x12, 0xd2, 0x64, 0x73, + 0x81, 0xa9, 0x9f, 0x9a, 0x5e, 0xd6, 0xe7, 0x53, 0x50, 0x9c, 0xc1, 0x4e, 0xeb, 0xc5, 0x93, 0x03, + 0xe8, 0xc5, 0x3e, 0xab, 0xd1, 0xa9, 0x62, 0x56, 0xa3, 0xd3, 0x47, 0x5f, 0x8d, 0xc6, 0x8e, 0x75, + 0x35, 0x42, 0x85, 0xac, 0x46, 0x03, 0x29, 0x7a, 0x63, 0xfb, 0x77, 0x76, 0x9f, 0xed, 0x5f, 0xbf, + 0xa5, 0xe8, 0xdc, 0xa1, 0x97, 0xa2, 0xfc, 0x55, 0xe6, 0x91, 0x43, 0xad, 0x32, 0x9f, 0x29, 0xc1, + 0x39, 0xad, 0x87, 0xe9, 0xe8, 0xf7, 0xd6, 0xa9, 0x26, 0x62, 0x77, 0xaa, 0xf0, 0x73, 0x1b, 0x23, + 0x25, 0x42, 0x67, 0x57, 0x28, 0x08, 0x36, 0xb0, 0x58, 0x66, 0x01, 0x89, 0x58, 0xf1, 0xcc, 0xac, + 0x92, 0x9e, 0x11, 0xed, 0x58, 0x61, 0xd0, 0xf1, 0x45, 0x7f, 0x8b, 0x6c, 0xad, 0x6c, 0x89, 0xa8, + 0x19, 0x0d, 0xc2, 0x26, 0x1e, 0x7a, 0x86, 0x33, 0x61, 0x0a, 0x82, 0x2a, 0xea, 0x51, 0x71, 0xc9, + 0xa2, 0xd4, 0x09, 0x0a, 0x2a, 0xc5, 0x61, 0x29, 0x24, 0xd5, 0x5e, 0x71, 0x58, 0x08, 0x94, 0xc2, + 0xb0, 0xff, 0xbb, 0x05, 0x8f, 0xe5, 0x76, 0xc5, 0x7d, 0x58, 0x7c, 0xb7, 0xd3, 0x8b, 0xef, 0x4a, + 0x51, 0xdb, 0x0d, 0xe3, 0x2d, 0xfa, 0x2c, 0xc4, 0xff, 0xd6, 0x82, 0x93, 0x1a, 0xff, 0x3e, 0xbc, + 0xaa, 0x97, 0x7e, 0xd5, 0xe2, 0x76, 0x56, 0xf5, 0x9e, 0x77, 0xfb, 0x03, 0xf6, 0x6e, 0x3c, 0xb8, + 0x62, 0xda, 0x95, 0x45, 0x31, 0xf7, 0x39, 0x49, 0xdc, 0x81, 0x21, 0x76, 0x10, 0x1a, 0x17, 0x13, + 0xe4, 0x91, 0xe6, 0xcf, 0x0e, 0x55, 0xf5, 0x21, 0x33, 0xfb, 0x1b, 0x63, 0xc1, 0x90, 0x95, 0x76, + 0xf5, 0x62, 0xaa, 0xcd, 0x9b, 0x22, 0x19, 0x43, 0x97, 0x76, 0x15, 0xed, 0x58, 0x61, 0xd8, 0x6d, + 0x18, 0x4f, 0x13, 0x9f, 0x25, 0xeb, 0x2c, 0x70, 0x70, 0xa0, 0xd7, 0x9c, 0x82, 0xba, 0xc3, 0x9e, + 0x5a, 0xe8, 0x3a, 0xd9, 0x7b, 0x79, 0xa7, 0x25, 0x00, 0x6b, 0x1c, 0xfb, 0x57, 0x2d, 0x38, 0x93, + 0xf3, 0x32, 0x05, 0x26, 0xa1, 0x24, 0x5a, 0x0b, 0xe4, 0x2d, 0xb8, 0xef, 0x86, 0xe1, 0x26, 0x59, + 0x77, 0x64, 0x68, 0x9a, 0xa1, 0x73, 0x67, 0x79, 0x33, 0x96, 0x70, 0xfb, 0xbf, 0x5a, 0x70, 0x2a, + 0x2d, 0x6b, 0x4c, 0xb5, 0x26, 0x7f, 0x99, 0x59, 0x2f, 0x76, 0xc3, 0x2d, 0x12, 0xed, 0xd0, 0x37, + 0xe7, 0x52, 0x2b, 0xad, 0x39, 0xdd, 0x83, 0x81, 0x73, 0x9e, 0x62, 0xc5, 0x14, 0x9b, 0xaa, 0xb7, + 0xe5, 0x48, 0xb9, 0x59, 0xe4, 0x48, 0xd1, 0x1f, 0xd3, 0x3c, 0xc6, 0x56, 0x2c, 0xb1, 0xc9, 0xdf, + 0xfe, 0x4e, 0x05, 0x54, 0x96, 0x1a, 0x8b, 0x0b, 0x2a, 0x28, 0xaa, 0x2a, 0x75, 0x17, 0x51, 0x79, + 0x80, 0xbb, 0x88, 0xe4, 0x60, 0xa8, 0xdc, 0xeb, 0xa0, 0x9e, 0x7b, 0x2f, 0x4c, 0x97, 0xa2, 0x7a, + 0xc3, 0x55, 0x0d, 0xc2, 0x26, 0x1e, 0x95, 0xc4, 0xf7, 0xb6, 0x08, 0x7f, 0x68, 0x28, 0x2d, 0xc9, + 0x82, 0x04, 0x60, 0x8d, 0x43, 0x25, 0x69, 0x7a, 0xeb, 0xeb, 0x62, 0x2b, 0xae, 0x24, 0xa1, 0xbd, + 0x83, 0x19, 0x84, 0xd7, 0xc7, 0x0d, 0x37, 0x85, 0x75, 0x6a, 0xd4, 0xc7, 0x0d, 0x37, 0x31, 0x83, + 0x50, 0x7b, 0x2a, 0x08, 0xa3, 0x36, 0xbb, 0x37, 0xb9, 0xa9, 0xb8, 0x08, 0xab, 0x54, 0xd9, 0x53, + 0xd7, 0x7b, 0x51, 0x70, 0xde, 0x73, 0x74, 0x04, 0x76, 0x22, 0xd2, 0xf4, 0xdc, 0xc4, 0xa4, 0x06, + 0xe9, 0x11, 0xb8, 0xdc, 0x83, 0x81, 0x73, 0x9e, 0x42, 0xd3, 0x70, 0x4a, 0x66, 0x19, 0xca, 0x1a, + 0x12, 0x23, 0xe9, 0x9c, 0x75, 0x9c, 0x06, 0xe3, 0x2c, 0x3e, 0xd5, 0x36, 0x6d, 0x51, 0x3e, 0x86, + 0x19, 0xb1, 0x86, 0xb6, 0x91, 0x65, 0x65, 0xb0, 0xc2, 0xb0, 0x3f, 0x55, 0xa6, 0xab, 0x63, 0x9f, + 0xb2, 0x49, 0xf7, 0x2d, 0x8a, 0x2f, 0x3d, 0x22, 0x2b, 0x03, 0x8c, 0xc8, 0x17, 0x60, 0xf4, 0x76, + 0x1c, 0x06, 0x2a, 0x42, 0xae, 0xda, 0x37, 0x42, 0xce, 0xc0, 0xca, 0x8f, 0x90, 0x1b, 0x2a, 0x2a, + 0x42, 0x6e, 0xf8, 0x90, 0x11, 0x72, 0xdf, 0xaa, 0x82, 0x2a, 0xd4, 0x7f, 0x9d, 0x24, 0x77, 0xc2, + 0x68, 0xd3, 0x0b, 0x5a, 0x2c, 0x3b, 0xf3, 0xeb, 0x16, 0x8c, 0xf2, 0xf9, 0xb2, 0x60, 0x66, 0x38, + 0xad, 0x17, 0x54, 0x01, 0x3e, 0xc5, 0x6c, 0x72, 0xd5, 0x60, 0x94, 0xb9, 0x5f, 0xce, 0x04, 0xe1, + 0x94, 0x44, 0xe8, 0xe3, 0x00, 0xd2, 0x6f, 0xb9, 0x2e, 0x55, 0xe6, 0x7c, 0x31, 0xf2, 0x61, 0xb2, + 0xae, 0x6d, 0xd3, 0x55, 0xc5, 0x04, 0x1b, 0x0c, 0xd1, 0x67, 0xb2, 0xf7, 0xca, 0x7f, 0xf4, 0x58, + 0xfa, 0x66, 0x90, 0xdc, 0x2f, 0x0c, 0xc3, 0x5e, 0xd0, 0xa2, 0xe3, 0x44, 0x44, 0x12, 0xbd, 0x2b, + 0x2f, 0xb3, 0x79, 0x21, 0x74, 0x9a, 0x0d, 0xc7, 0x77, 0x02, 0x97, 0x44, 0xf3, 0x1c, 0xdd, 0xbc, + 0x55, 0x95, 0x35, 0x60, 0x49, 0xa8, 0xe7, 0x8a, 0x83, 0xea, 0x20, 0x57, 0x1c, 0x9c, 0xff, 0x00, + 0x8c, 0xf5, 0x7c, 0xcc, 0x03, 0xa5, 0x7a, 0x1d, 0x3e, 0x4b, 0xcc, 0xfe, 0xa7, 0x43, 0x7a, 0xd1, + 0xba, 0x1e, 0x36, 0x79, 0xa1, 0xfd, 0x48, 0x7f, 0x51, 0x61, 0x7b, 0x16, 0x38, 0x44, 0x8c, 0x9b, + 0x59, 0x55, 0x23, 0x36, 0x59, 0xd2, 0x31, 0xda, 0x71, 0x22, 0x12, 0x1c, 0xf7, 0x18, 0x5d, 0x56, + 0x4c, 0xb0, 0xc1, 0x10, 0x6d, 0xa4, 0x72, 0x3d, 0x2e, 0x1f, 0x3d, 0xd7, 0x83, 0xd5, 0x7c, 0xc9, + 0xab, 0x8d, 0xfd, 0x25, 0x0b, 0x4e, 0x06, 0xa9, 0x91, 0x5b, 0x4c, 0x78, 0x67, 0xfe, 0xac, 0xe0, + 0xf7, 0xbc, 0xa4, 0xdb, 0x70, 0x86, 0x7f, 0xde, 0x92, 0x56, 0x3d, 0xe0, 0x92, 0xa6, 0x6f, 0xec, + 0x18, 0xea, 0x77, 0x63, 0x07, 0x0a, 0xd4, 0x95, 0x45, 0xc3, 0x85, 0x5f, 0x59, 0x04, 0x39, 0xd7, + 0x15, 0xdd, 0x82, 0xba, 0x1b, 0x11, 0x27, 0x39, 0xe4, 0xed, 0x35, 0xec, 0xe0, 0x7c, 0x46, 0x12, + 0xc0, 0x9a, 0x96, 0xfd, 0xbf, 0x2b, 0x70, 0x5a, 0xf6, 0x88, 0x0c, 0x0d, 0xa7, 0xeb, 0x23, 0xe7, + 0xab, 0x8d, 0x5b, 0xb5, 0x3e, 0x5e, 0x91, 0x00, 0xac, 0x71, 0xa8, 0x3d, 0xd6, 0x8d, 0xc9, 0x52, + 0x87, 0x04, 0x0b, 0xde, 0x5a, 0x2c, 0xce, 0x1f, 0xd5, 0x44, 0xb9, 0xa1, 0x41, 0xd8, 0xc4, 0xa3, + 0xc6, 0x38, 0xb7, 0x8b, 0xe3, 0x6c, 0x5a, 0x89, 0xb0, 0xb7, 0xb1, 0x84, 0xa3, 0x5f, 0xc8, 0xad, + 0xe3, 0x58, 0x4c, 0x42, 0x55, 0x4f, 0x44, 0xfc, 0x01, 0x2f, 0x3c, 0xfb, 0x1b, 0x16, 0x9c, 0xe3, + 0xad, 0xb2, 0x27, 0x6f, 0x74, 0x9a, 0x4e, 0x42, 0xe2, 0x62, 0xea, 0x2a, 0xe7, 0xc8, 0xa7, 0x9d, + 0xaf, 0x79, 0x6c, 0x71, 0xbe, 0x34, 0xe8, 0x8b, 0x16, 0x9c, 0xda, 0x4c, 0x65, 0xe0, 0xcb, 0xa5, + 0xe3, 0x88, 0xb5, 0x62, 0xd2, 0x69, 0xfd, 0x7a, 0xaa, 0xa5, 0xdb, 0x63, 0x9c, 0xe5, 0x6e, 0xff, + 0x89, 0x05, 0xa6, 0x1a, 0x1d, 0xcc, 0x02, 0x34, 0xae, 0x98, 0x2d, 0xed, 0x73, 0xc5, 0xac, 0x34, + 0x16, 0xcb, 0x83, 0x6d, 0x4e, 0x2a, 0x07, 0xd8, 0x9c, 0x54, 0xfb, 0x5a, 0x97, 0x4f, 0x40, 0xb9, + 0xeb, 0x35, 0xc5, 0xfe, 0x42, 0x9f, 0x8a, 0xce, 0xcf, 0x62, 0xda, 0x6e, 0xff, 0xa3, 0xaa, 0xf6, + 0x27, 0x88, 0x7c, 0xa5, 0xef, 0x8b, 0xd7, 0x5e, 0x57, 0xa5, 0x7f, 0xf8, 0x9b, 0x5f, 0xef, 0x29, + 0xfd, 0xf3, 0x23, 0x07, 0x4f, 0x47, 0xe3, 0x1d, 0xd4, 0xaf, 0xf2, 0xcf, 0xf0, 0x3e, 0xb9, 0x68, + 0xb7, 0xa1, 0x46, 0xb7, 0x60, 0xcc, 0x31, 0x58, 0x4b, 0x09, 0x55, 0xbb, 0x22, 0xda, 0xef, 0xee, + 0x4e, 0xfc, 0xf0, 0xc1, 0xc5, 0x92, 0x4f, 0x63, 0x45, 0x1f, 0xc5, 0x50, 0xa7, 0xbf, 0x59, 0xda, + 0x9c, 0xd8, 0xdc, 0xdd, 0x50, 0x3a, 0x53, 0x02, 0x0a, 0xc9, 0xc9, 0xd3, 0x7c, 0x50, 0x00, 0x75, + 0x76, 0x37, 0x24, 0x63, 0xca, 0xf7, 0x80, 0xcb, 0x2a, 0x79, 0x4d, 0x02, 0xee, 0xee, 0x4e, 0xbc, + 0x7c, 0x70, 0xa6, 0xea, 0x71, 0xac, 0x59, 0xd8, 0x5f, 0xae, 0xe8, 0xb1, 0x2b, 0x2a, 0x3e, 0x7d, + 0x5f, 0x8c, 0xdd, 0x97, 0x32, 0x63, 0xf7, 0x42, 0xcf, 0xd8, 0x3d, 0xa9, 0xef, 0x30, 0x4c, 0x8d, + 0xc6, 0xfb, 0x6d, 0x08, 0xec, 0xef, 0x6f, 0x60, 0x16, 0xd0, 0x1b, 0x5d, 0x2f, 0x22, 0xf1, 0x72, + 0xd4, 0x0d, 0xbc, 0xa0, 0x25, 0xee, 0xa6, 0x37, 0x2c, 0xa0, 0x14, 0x18, 0x67, 0xf1, 0xd9, 0xbd, + 0xf6, 0x3b, 0x81, 0x7b, 0xcb, 0xd9, 0xe2, 0xa3, 0xca, 0x28, 0x82, 0xb3, 0x22, 0xda, 0xb1, 0xc2, + 0xb0, 0xdf, 0x62, 0x67, 0xcc, 0x46, 0xbe, 0x2e, 0x1d, 0x13, 0x3e, 0xbb, 0x8c, 0x93, 0x57, 0xd0, + 0x51, 0x63, 0x82, 0xdf, 0xc0, 0xc9, 0x61, 0xe8, 0x0e, 0x0c, 0xaf, 0xf1, 0xdb, 0xa8, 0x8a, 0xa9, + 0x16, 0x2c, 0xae, 0xb6, 0x62, 0x77, 0x0e, 0xc8, 0x7b, 0xae, 0xee, 0xea, 0x9f, 0x58, 0x72, 0xb3, + 0xbf, 0x59, 0x81, 0x53, 0x99, 0xeb, 0x1a, 0x53, 0xb5, 0x0b, 0x4b, 0xfb, 0xd6, 0x2e, 0xfc, 0x08, + 0x40, 0x93, 0x74, 0xfc, 0x70, 0x87, 0x99, 0x63, 0x95, 0x03, 0x9b, 0x63, 0xca, 0x82, 0x9f, 0x55, + 0x54, 0xb0, 0x41, 0x51, 0x94, 0x0d, 0xe2, 0xa5, 0x10, 0x33, 0x65, 0x83, 0x8c, 0x9a, 0xe2, 0x43, + 0xf7, 0xb7, 0xa6, 0xb8, 0x07, 0xa7, 0xb8, 0x88, 0x2a, 0x2b, 0xf6, 0x10, 0xc9, 0xaf, 0x2c, 0xaf, + 0x60, 0x36, 0x4d, 0x06, 0x67, 0xe9, 0x3e, 0xc8, 0xdb, 0x58, 0xd1, 0x7b, 0xa0, 0x2e, 0xbf, 0x73, + 0x3c, 0x5e, 0xd7, 0x95, 0x05, 0xe4, 0x30, 0x60, 0xb7, 0xa4, 0x8a, 0x9f, 0xf6, 0x17, 0x4a, 0xd4, + 0x7a, 0xe6, 0xff, 0x54, 0x85, 0x98, 0xa7, 0x61, 0xc8, 0xe9, 0x26, 0x1b, 0x61, 0xcf, 0x8d, 0x56, + 0xd3, 0xac, 0x15, 0x0b, 0x28, 0x5a, 0x80, 0x4a, 0x53, 0x57, 0xfd, 0x38, 0x48, 0x2f, 0x6a, 0x47, + 0xa4, 0x93, 0x10, 0xcc, 0xa8, 0xa0, 0xc7, 0xa1, 0x92, 0x38, 0x2d, 0x99, 0x80, 0xc4, 0x92, 0x4e, + 0x57, 0x9d, 0x56, 0x8c, 0x59, 0xab, 0xb9, 0x68, 0x56, 0xf6, 0x59, 0x34, 0x5f, 0x86, 0x13, 0xb1, + 0xd7, 0x0a, 0x9c, 0xa4, 0x1b, 0x11, 0xe3, 0xd0, 0x4b, 0xc7, 0x31, 0x98, 0x40, 0x9c, 0xc6, 0xb5, + 0x7f, 0x73, 0x14, 0xce, 0xae, 0xcc, 0x2c, 0xca, 0x0a, 0xb6, 0xc7, 0x96, 0x43, 0x94, 0xc7, 0xe3, + 0xfe, 0xe5, 0x10, 0xf5, 0xe1, 0xee, 0x1b, 0x39, 0x44, 0xbe, 0x91, 0x43, 0x94, 0x4e, 0xe8, 0x28, + 0x17, 0x91, 0xd0, 0x91, 0x27, 0xc1, 0x20, 0x09, 0x1d, 0xc7, 0x96, 0x54, 0x74, 0x4f, 0x81, 0x0e, + 0x94, 0x54, 0xa4, 0x32, 0xae, 0x0a, 0x09, 0xb5, 0xef, 0xf3, 0xa9, 0x72, 0x33, 0xae, 0x54, 0xb6, + 0x0b, 0x4f, 0x23, 0x11, 0x0a, 0xf6, 0xb5, 0xe2, 0x05, 0x18, 0x20, 0xdb, 0x45, 0x64, 0xb2, 0x98, + 0x19, 0x56, 0xc3, 0x45, 0x64, 0x58, 0xe5, 0x89, 0xb3, 0x6f, 0x86, 0xd5, 0xcb, 0x70, 0xc2, 0xf5, + 0xc3, 0x80, 0x2c, 0x47, 0x61, 0x12, 0xba, 0xa1, 0x2f, 0x8c, 0x69, 0xa5, 0x12, 0x66, 0x4c, 0x20, + 0x4e, 0xe3, 0xf6, 0x4b, 0xcf, 0xaa, 0x1f, 0x35, 0x3d, 0x0b, 0x1e, 0x50, 0x7a, 0xd6, 0xcf, 0xea, + 0x44, 0xe2, 0x11, 0xf6, 0x45, 0x3e, 0x52, 0xfc, 0x17, 0x19, 0x24, 0x9b, 0x18, 0x7d, 0x95, 0x5f, + 0x29, 0x45, 0xcd, 0xd1, 0x99, 0xb0, 0x4d, 0xcd, 0xad, 0x51, 0xd6, 0x25, 0xaf, 0x1f, 0xc3, 0x80, + 0xbd, 0xb5, 0xa2, 0xd9, 0xa8, 0x6b, 0xa6, 0x74, 0x13, 0x4e, 0x0b, 0x72, 0x94, 0x44, 0xe7, 0xaf, + 0x95, 0xe0, 0x07, 0xf6, 0x15, 0x01, 0xdd, 0x01, 0x48, 0x9c, 0x96, 0x18, 0xa8, 0xe2, 0x98, 0xe2, + 0x88, 0xc1, 0x86, 0xab, 0x92, 0x1e, 0xaf, 0xd0, 0xa1, 0xfe, 0xb2, 0x03, 0x00, 0xf9, 0x9b, 0xc5, + 0x18, 0x86, 0x7e, 0x4f, 0x35, 0x42, 0x1c, 0xfa, 0x04, 0x33, 0x08, 0x5d, 0xfe, 0x23, 0xd2, 0xd2, + 0x77, 0xa0, 0xaa, 0xcf, 0x87, 0x59, 0x2b, 0x16, 0x50, 0xf4, 0x22, 0x8c, 0x38, 0xbe, 0xcf, 0xb3, + 0x45, 0xd8, 0x95, 0x24, 0x29, 0x9f, 0xd9, 0xb4, 0x06, 0x61, 0x13, 0xcf, 0xfe, 0xe3, 0x12, 0x4c, + 0xec, 0xa3, 0x53, 0x7a, 0xf2, 0xdf, 0xaa, 0x03, 0xe7, 0xbf, 0x89, 0x88, 0xfd, 0xa1, 0x3e, 0x11, + 0xfb, 0x2f, 0xc2, 0x48, 0x42, 0x9c, 0xb6, 0x08, 0x4f, 0x12, 0xfb, 0x6f, 0x7d, 0xee, 0xaa, 0x41, + 0xd8, 0xc4, 0xa3, 0x5a, 0xec, 0xa4, 0xe3, 0xba, 0x24, 0x8e, 0x65, 0x48, 0xbe, 0xf0, 0x61, 0x16, + 0x16, 0xef, 0xcf, 0x5c, 0xc3, 0xd3, 0x29, 0x16, 0x38, 0xc3, 0x32, 0xdb, 0xe1, 0xf5, 0x01, 0x3b, + 0xfc, 0x1b, 0x25, 0x78, 0xe2, 0x9e, 0xab, 0xdb, 0xc0, 0xd9, 0x12, 0xdd, 0x98, 0x44, 0xd9, 0x81, + 0x73, 0x23, 0x26, 0x11, 0x66, 0x10, 0xde, 0x4b, 0x9d, 0x8e, 0x71, 0xc7, 0x6c, 0xd1, 0xa9, 0x3c, + 0xbc, 0x97, 0x52, 0x2c, 0x70, 0x86, 0xe5, 0x61, 0x87, 0xe5, 0xdf, 0x29, 0xc1, 0x53, 0x03, 0xd8, + 0x00, 0x05, 0xa6, 0x3c, 0xa5, 0x13, 0xcf, 0xca, 0x0f, 0x28, 0x3f, 0xf0, 0x90, 0xdd, 0xf5, 0x56, + 0x09, 0xce, 0xf7, 0x5f, 0x8a, 0xd1, 0x8f, 0xd2, 0x3d, 0xbc, 0x8c, 0x49, 0x32, 0x73, 0xd6, 0xce, + 0xf0, 0xfd, 0x7b, 0x0a, 0x84, 0xb3, 0xb8, 0x68, 0x12, 0xa0, 0xe3, 0x24, 0x1b, 0xf1, 0xa5, 0x6d, + 0x2f, 0x4e, 0x44, 0x4d, 0x96, 0x93, 0xfc, 0xc4, 0x48, 0xb6, 0x62, 0x03, 0x83, 0xb2, 0x63, 0xff, + 0x66, 0xc3, 0xeb, 0x61, 0xc2, 0x1f, 0xe2, 0xdb, 0x88, 0x33, 0xb2, 0x6e, 0xbd, 0x01, 0xc2, 0x59, + 0x5c, 0xca, 0x8e, 0x9d, 0x49, 0x72, 0x41, 0xf9, 0xfe, 0x82, 0xb1, 0x5b, 0x50, 0xad, 0xd8, 0xc0, + 0xc8, 0x66, 0xe3, 0x55, 0xf7, 0xcf, 0xc6, 0xb3, 0xff, 0x61, 0x09, 0x1e, 0xeb, 0x6b, 0xca, 0x0d, + 0x36, 0x01, 0x1f, 0xbe, 0x0c, 0xba, 0xc3, 0x8d, 0x9d, 0x03, 0x66, 0x7a, 0xfd, 0x61, 0x9f, 0x91, + 0x26, 0x32, 0xbd, 0x0e, 0x9f, 0x2a, 0xfd, 0xf0, 0xf5, 0x67, 0x4f, 0x72, 0x57, 0xe5, 0x00, 0xc9, + 0x5d, 0x99, 0x8f, 0x51, 0x1d, 0x70, 0x22, 0xff, 0xdf, 0xfe, 0xdd, 0x4b, 0xb7, 0x7e, 0x03, 0x79, + 0x47, 0x67, 0xe1, 0xb4, 0x17, 0xb0, 0x3b, 0x4c, 0x56, 0xba, 0x6b, 0xa2, 0x4c, 0x47, 0x29, 0x7d, + 0x83, 0xf0, 0x7c, 0x06, 0x8e, 0x7b, 0x9e, 0x78, 0x08, 0x93, 0xed, 0x0e, 0xd7, 0xa5, 0x07, 0x4c, + 0xf7, 0xfc, 0x08, 0xd4, 0x95, 0x24, 0x3c, 0xdc, 0x58, 0x7d, 0xfe, 0x9e, 0x70, 0x63, 0xf5, 0xed, + 0x0d, 0x2c, 0xda, 0x6f, 0xd4, 0x38, 0xcd, 0x8c, 0xe3, 0x6b, 0x64, 0x87, 0x59, 0xaa, 0xf6, 0x7b, + 0x61, 0x54, 0x79, 0x3c, 0x06, 0xbd, 0xd6, 0xc2, 0xfe, 0xf2, 0x10, 0x9c, 0x48, 0x15, 0xad, 0x4b, + 0x39, 0x18, 0xad, 0x7d, 0x1d, 0x8c, 0x2c, 0x7c, 0xbc, 0x1b, 0xc8, 0x3b, 0x6f, 0x8c, 0xf0, 0xf1, + 0x6e, 0x40, 0x30, 0x87, 0x51, 0x43, 0xb3, 0x19, 0xed, 0xe0, 0x6e, 0x20, 0xc2, 0x3c, 0x95, 0xa1, + 0x39, 0xcb, 0x5a, 0xb1, 0x80, 0xa2, 0x4f, 0x5a, 0x30, 0x1a, 0x33, 0xef, 0x35, 0x77, 0xcf, 0x8a, + 0xcf, 0x7f, 0xf5, 0xe8, 0x35, 0xf9, 0x54, 0x81, 0x46, 0x16, 0x21, 0x62, 0xb6, 0xe0, 0x14, 0x47, + 0xf4, 0xd3, 0x16, 0xd4, 0x55, 0x69, 0x7e, 0x71, 0x31, 0xd5, 0x4a, 0xb1, 0x35, 0x01, 0xb9, 0x5f, + 0x4f, 0x1d, 0x04, 0xe8, 0xbb, 0xb6, 0x35, 0x63, 0x14, 0x2b, 0xdf, 0xe9, 0xf0, 0xf1, 0xf8, 0x4e, + 0x21, 0xc7, 0x6f, 0xfa, 0x1e, 0xa8, 0xb7, 0x9d, 0xc0, 0x5b, 0x27, 0x71, 0xc2, 0xdd, 0x99, 0xb2, + 0x54, 0xa9, 0x6c, 0xc4, 0x1a, 0x4e, 0x97, 0xc6, 0x98, 0xbd, 0x58, 0x62, 0xf8, 0x1f, 0xd9, 0xd2, + 0xb8, 0xa2, 0x9b, 0xb1, 0x89, 0x63, 0x3a, 0x4b, 0xe1, 0x81, 0x3a, 0x4b, 0x47, 0xf6, 0x71, 0x96, + 0xfe, 0x3d, 0x0b, 0xce, 0xe5, 0x7e, 0xb5, 0x87, 0x37, 0xf0, 0xcf, 0xfe, 0x4a, 0x15, 0xce, 0xe4, + 0x54, 0x9f, 0x44, 0x3b, 0xe6, 0x78, 0xb6, 0x8a, 0x38, 0x43, 0x4f, 0x1f, 0x09, 0xcb, 0x6e, 0xcc, + 0x19, 0xc4, 0x07, 0x3b, 0xaa, 0xd0, 0xc7, 0x05, 0xe5, 0xfb, 0x7b, 0x5c, 0x60, 0x0c, 0xcb, 0xca, + 0x03, 0x1d, 0x96, 0xd5, 0x7b, 0x0f, 0x4b, 0xf4, 0x6b, 0x16, 0x8c, 0xb7, 0xfb, 0x94, 0x3c, 0x17, + 0x2e, 0xc0, 0x9b, 0xc7, 0x53, 0x50, 0xbd, 0xf1, 0xf8, 0xde, 0xee, 0x44, 0xdf, 0x4a, 0xf3, 0xb8, + 0xaf, 0x54, 0xf6, 0x77, 0xca, 0xc0, 0x4a, 0x9f, 0xb2, 0x0a, 0x63, 0x3b, 0xe8, 0x13, 0x66, 0x11, + 0x5b, 0xab, 0xa8, 0x82, 0xab, 0x9c, 0xb8, 0x2a, 0x82, 0xcb, 0x7b, 0x30, 0xaf, 0x26, 0x6e, 0x56, + 0x69, 0x95, 0x06, 0x50, 0x5a, 0xbe, 0xac, 0x16, 0x5c, 0x2e, 0xbe, 0x5a, 0x70, 0x3d, 0x5b, 0x29, + 0xf8, 0xde, 0x9f, 0xb8, 0xf2, 0x50, 0x7e, 0xe2, 0xbf, 0x66, 0x71, 0xc5, 0x93, 0xf9, 0x0a, 0xda, + 0x32, 0xb0, 0xee, 0x61, 0x19, 0x3c, 0xcb, 0x6e, 0x4d, 0x5f, 0xbf, 0x42, 0x1c, 0x5f, 0x58, 0x10, + 0xe6, 0x05, 0xe8, 0xac, 0x1d, 0x2b, 0x0c, 0x76, 0x89, 0xa0, 0xef, 0x87, 0x77, 0x2e, 0xb5, 0x3b, + 0xc9, 0x8e, 0xb0, 0x25, 0xf4, 0x25, 0x82, 0x0a, 0x82, 0x0d, 0x2c, 0xfb, 0xaf, 0x97, 0xf8, 0x08, + 0x14, 0x41, 0x00, 0x2f, 0x65, 0xae, 0x7d, 0x1a, 0xfc, 0xfc, 0xfc, 0x63, 0x00, 0xae, 0xba, 0x30, + 0x59, 0x9c, 0xce, 0x5c, 0x39, 0xf2, 0x6d, 0xae, 0x82, 0x9e, 0x7e, 0x0d, 0xdd, 0x86, 0x0d, 0x7e, + 0x29, 0x5d, 0x5a, 0xde, 0x57, 0x97, 0xa6, 0xd4, 0x4a, 0x65, 0x9f, 0xd5, 0xee, 0x8f, 0x2d, 0x48, + 0x59, 0x44, 0xa8, 0x03, 0x55, 0x2a, 0xee, 0x4e, 0x31, 0x77, 0x41, 0x9b, 0xa4, 0xa9, 0x6a, 0x14, + 0xc3, 0x9e, 0xfd, 0xc4, 0x9c, 0x11, 0xf2, 0x45, 0xac, 0x40, 0xa9, 0x88, 0xfb, 0xca, 0x4d, 0x86, + 0x57, 0xc2, 0x70, 0x93, 0x1f, 0x31, 0xea, 0xb8, 0x03, 0xfb, 0x25, 0x18, 0xeb, 0x11, 0x8a, 0xdd, + 0xf0, 0x12, 0xca, 0x0b, 0xb0, 0x8d, 0xe1, 0xca, 0x12, 0x0b, 0x31, 0x87, 0xd9, 0x6f, 0x59, 0x70, + 0x3a, 0x4b, 0x1e, 0x7d, 0xd5, 0x82, 0xb1, 0x38, 0x4b, 0xef, 0xb8, 0xfa, 0x4e, 0xc5, 0xfb, 0xf5, + 0x80, 0x70, 0xaf, 0x10, 0xf6, 0xff, 0x11, 0x83, 0xff, 0x96, 0x17, 0x34, 0xc3, 0x3b, 0xca, 0x30, + 0xb1, 0xfa, 0x1a, 0x26, 0x74, 0x3e, 0xba, 0x1b, 0xa4, 0xd9, 0xf5, 0x7b, 0x32, 0x1a, 0x57, 0x44, + 0x3b, 0x56, 0x18, 0x2c, 0x81, 0xab, 0x2b, 0xca, 0x89, 0x67, 0x06, 0xe5, 0xac, 0x68, 0xc7, 0x0a, + 0x03, 0xbd, 0x00, 0xa3, 0xe6, 0x25, 0xef, 0x62, 0x5c, 0x32, 0x83, 0xdc, 0xbc, 0x0f, 0x1e, 0xa7, + 0xb0, 0xd0, 0x24, 0x80, 0x32, 0x72, 0xe4, 0x12, 0xc9, 0x5c, 0x36, 0x4a, 0x13, 0xc5, 0xd8, 0xc0, + 0x60, 0xe9, 0x92, 0xfc, 0x26, 0x75, 0x19, 0x15, 0xcb, 0xd3, 0x25, 0x45, 0x1b, 0x56, 0x50, 0xaa, + 0x4d, 0xda, 0x4e, 0xd0, 0x75, 0x7c, 0xda, 0x43, 0x22, 0xc7, 0x5b, 0x4d, 0xc3, 0x45, 0x05, 0xc1, + 0x06, 0x16, 0x7d, 0xe3, 0xc4, 0x6b, 0x93, 0x57, 0xc3, 0x40, 0xc6, 0x69, 0xe9, 0x03, 0x18, 0xd1, + 0x8e, 0x15, 0x86, 0xfd, 0x9f, 0x2d, 0x38, 0xa5, 0x93, 0xaf, 0xf9, 0x5d, 0xae, 0xe6, 0x9e, 0xd1, + 0xda, 0x37, 0xaf, 0x3c, 0x9d, 0x95, 0x5a, 0x1a, 0x28, 0x2b, 0xd5, 0x4c, 0x18, 0x2d, 0xdf, 0x33, + 0x61, 0xf4, 0x07, 0xf5, 0x3d, 0x81, 0x3c, 0xb3, 0x74, 0x24, 0xef, 0x8e, 0x40, 0x64, 0xc3, 0x90, + 0xeb, 0xa8, 0xca, 0x23, 0xa3, 0x7c, 0xef, 0x30, 0x33, 0xcd, 0x90, 0x04, 0xc4, 0x5e, 0x82, 0xba, + 0x3a, 0x87, 0x90, 0x1b, 0x55, 0x2b, 0x7f, 0xa3, 0x3a, 0x50, 0x82, 0x5c, 0x63, 0xed, 0x9b, 0xdf, + 0x7d, 0xf2, 0x1d, 0xbf, 0xf3, 0xdd, 0x27, 0xdf, 0xf1, 0xfb, 0xdf, 0x7d, 0xf2, 0x1d, 0x9f, 0xdc, + 0x7b, 0xd2, 0xfa, 0xe6, 0xde, 0x93, 0xd6, 0xef, 0xec, 0x3d, 0x69, 0xfd, 0xfe, 0xde, 0x93, 0xd6, + 0x77, 0xf6, 0x9e, 0xb4, 0xbe, 0xf4, 0x1f, 0x9e, 0x7c, 0xc7, 0xab, 0xb9, 0x81, 0x7a, 0xf4, 0xc7, + 0x73, 0x6e, 0x73, 0x6a, 0xeb, 0x22, 0x8b, 0x15, 0xa3, 0xd3, 0x6b, 0xca, 0x18, 0x53, 0x53, 0x72, + 0x7a, 0xfd, 0xff, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe1, 0x5f, 0x0c, 0xde, 0x1c, 0xd9, 0x00, 0x00, } func (m *AWSAuthConfig) Marshal() (dAtA []byte, err error) { @@ -10753,6 +10753,14 @@ func (m *PullRequestGeneratorGitLab) MarshalToSizedBuffer(dAtA []byte) (int, err _ = i var l int _ = l + i-- + if m.Insecure { + dAtA[i] = 1 + } else { + dAtA[i] = 0 + } + i-- + dAtA[i] = 0x30 i -= len(m.PullRequestState) copy(dAtA[i:], m.PullRequestState) i = encodeVarintGenerated(dAtA, i, uint64(len(m.PullRequestState))) @@ -13016,6 +13024,14 @@ func (m *SCMProviderGeneratorGitlab) MarshalToSizedBuffer(dAtA []byte) (int, err var l int _ = l i-- + if m.Insecure { + dAtA[i] = 1 + } else { + dAtA[i] = 0 + } + i-- + dAtA[i] = 0x30 + i-- if m.AllBranches { dAtA[i] = 1 } else { @@ -16011,6 +16027,7 @@ func (m *PullRequestGeneratorGitLab) Size() (n int) { } l = len(m.PullRequestState) n += 1 + l + sovGenerated(uint64(l)) + n += 2 return n } @@ -16838,6 +16855,7 @@ func (m *SCMProviderGeneratorGitlab) Size() (n int) { n += 1 + l + sovGenerated(uint64(l)) } n += 2 + n += 2 return n } @@ -18813,6 +18831,7 @@ func (this *PullRequestGeneratorGitLab) String() string { `TokenRef:` + strings.Replace(this.TokenRef.String(), "SecretRef", "SecretRef", 1) + `,`, `Labels:` + fmt.Sprintf("%v", this.Labels) + `,`, `PullRequestState:` + fmt.Sprintf("%v", this.PullRequestState) + `,`, + `Insecure:` + fmt.Sprintf("%v", this.Insecure) + `,`, `}`, }, "") return s @@ -19405,6 +19424,7 @@ func (this *SCMProviderGeneratorGitlab) String() string { `API:` + fmt.Sprintf("%v", this.API) + `,`, `TokenRef:` + strings.Replace(this.TokenRef.String(), "SecretRef", "SecretRef", 1) + `,`, `AllBranches:` + fmt.Sprintf("%v", this.AllBranches) + `,`, + `Insecure:` + fmt.Sprintf("%v", this.Insecure) + `,`, `}`, }, "") return s @@ -38125,6 +38145,26 @@ func (m *PullRequestGeneratorGitLab) Unmarshal(dAtA []byte) error { } m.PullRequestState = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex + case 6: + if wireType != 0 { + return fmt.Errorf("proto: wrong wireType = %d for field Insecure", wireType) + } + var v int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + v |= int(b&0x7F) << shift + if b < 0x80 { + break + } + } + m.Insecure = bool(v != 0) default: iNdEx = preIndex skippy, err := skipGenerated(dAtA[iNdEx:]) @@ -46196,6 +46236,26 @@ func (m *SCMProviderGeneratorGitlab) Unmarshal(dAtA []byte) error { } } m.AllBranches = bool(v != 0) + case 6: + if wireType != 0 { + return fmt.Errorf("proto: wrong wireType = %d for field Insecure", wireType) + } + var v int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + v |= int(b&0x7F) << shift + if b < 0x80 { + break + } + } + m.Insecure = bool(v != 0) default: iNdEx = preIndex skippy, err := skipGenerated(dAtA[iNdEx:]) diff --git a/pkg/apis/application/v1alpha1/generated.proto b/pkg/apis/application/v1alpha1/generated.proto index b30af08553a59..67fcf772d731b 100644 --- a/pkg/apis/application/v1alpha1/generated.proto +++ b/pkg/apis/application/v1alpha1/generated.proto @@ -1376,6 +1376,9 @@ message PullRequestGeneratorGitLab { // PullRequestState is an additional MRs filter to get only those with a certain state. Default: "" (all states) optional string pullRequestState = 5; + + // Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false + optional bool insecure = 6; } // PullRequestGeneratorGitea defines connection info specific to Gitea. @@ -2022,6 +2025,9 @@ message SCMProviderGeneratorGitlab { // Scan all branches instead of just the default branch. optional bool allBranches = 5; + + // Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false + optional bool insecure = 6; } // Utility struct for a reference to a secret key. diff --git a/pkg/apis/application/v1alpha1/openapi_generated.go b/pkg/apis/application/v1alpha1/openapi_generated.go index 3f73841a531a7..d96f744fbe65f 100644 --- a/pkg/apis/application/v1alpha1/openapi_generated.go +++ b/pkg/apis/application/v1alpha1/openapi_generated.go @@ -4863,6 +4863,13 @@ func schema_pkg_apis_application_v1alpha1_PullRequestGeneratorGitLab(ref common. Format: "", }, }, + "insecure": { + SchemaProps: spec.SchemaProps{ + Description: "Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false", + Type: []string{"boolean"}, + Format: "", + }, + }, }, Required: []string{"project"}, }, @@ -6923,6 +6930,13 @@ func schema_pkg_apis_application_v1alpha1_SCMProviderGeneratorGitlab(ref common. Format: "", }, }, + "insecure": { + SchemaProps: spec.SchemaProps{ + Description: "Skips validating the SCM provider's TLS certificate - useful for self-signed certificates.; default: false", + Type: []string{"boolean"}, + Format: "", + }, + }, }, Required: []string{"group"}, }, From 22281c5aab82d2d7125392cc8df41f4cbbd4a90a Mon Sep 17 00:00:00 2001 From: Matt Kelly Date: Tue, 11 Jul 2023 14:51:16 -0400 Subject: [PATCH 13/17] chore: Add VA.gov to USERS.md (#14401) * Add VA.gov to USERS.md FWIW, we use ArgoCD all over the place at the VA. Signed-off-by: Matt Kelly * Slightly different sort opinion Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --------- Signed-off-by: Matt Kelly Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Co-authored-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --- USERS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/USERS.md b/USERS.md index 8fc9f6cd414f2..5d83fde59ed32 100644 --- a/USERS.md +++ b/USERS.md @@ -273,6 +273,7 @@ Currently, the following organizations are **officially** using Argo CD: 1. [Trusting Social](https://trustingsocial.com/) 1. [Twilio SendGrid](https://sendgrid.com) 1. [tZERO](https://www.tzero.com/) +1. [U.S. Veterans Affairs Department](https://www.va.gov/) 1. [UBIO](https://ub.io/) 1. [UFirstGroup](https://www.ufirstgroup.com/en/) 1. [ungleich.ch](https://ungleich.ch/) From 103a41992eac24101bcf3b0a2637379249d1e6e4 Mon Sep 17 00:00:00 2001 From: Maxime Brunet Date: Wed, 12 Jul 2023 06:35:35 -0700 Subject: [PATCH 14/17] fix(cli): fix tracking annotation diff for non-namespaced resources (#13924) Signed-off-by: Maxime Brunet --- cmd/argocd/commands/app.go | 10 +++--- test/e2e/cluster_objects_test.go | 34 ++++++++++++++++++- .../cluster-role-hook/cluster-role.yaml | 15 ++++++++ .../pod.yaml | 0 .../testdata/cluster-role/cluster-role.yaml | 5 +-- 5 files changed, 54 insertions(+), 10 deletions(-) create mode 100644 test/e2e/testdata/cluster-role-hook/cluster-role.yaml rename test/e2e/testdata/{cluster-role => cluster-role-hook}/pod.yaml (100%) diff --git a/cmd/argocd/commands/app.go b/cmd/argocd/commands/app.go index 8bb7b0b8e8968..f45efb427053c 100644 --- a/cmd/argocd/commands/app.go +++ b/cmd/argocd/commands/app.go @@ -1027,7 +1027,7 @@ func findandPrintDiff(ctx context.Context, app *argoappv1.Application, proj *arg items := make([]objKeyLiveTarget, 0) if diffOptions.local != "" { localObjs := groupObjsByKey(getLocalObjects(ctx, app, proj, diffOptions.local, diffOptions.localRepoRoot, argoSettings.AppLabelKey, diffOptions.cluster.Info.ServerVersion, diffOptions.cluster.Info.APIVersions, argoSettings.KustomizeOptions, argoSettings.TrackingMethod), liveObjs, app.Spec.Destination.Namespace) - items = groupObjsForDiff(resources, localObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace)) + items = groupObjsForDiff(resources, localObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace), app.Spec.Destination.Namespace) } else if diffOptions.revision != "" { var unstructureds []*unstructured.Unstructured for _, mfst := range diffOptions.res.Manifests { @@ -1036,7 +1036,7 @@ func findandPrintDiff(ctx context.Context, app *argoappv1.Application, proj *arg unstructureds = append(unstructureds, obj) } groupedObjs := groupObjsByKey(unstructureds, liveObjs, app.Spec.Destination.Namespace) - items = groupObjsForDiff(resources, groupedObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace)) + items = groupObjsForDiff(resources, groupedObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace), app.Spec.Destination.Namespace) } else if diffOptions.serversideRes != nil { var unstructureds []*unstructured.Unstructured for _, mfst := range diffOptions.serversideRes.Manifests { @@ -1045,7 +1045,7 @@ func findandPrintDiff(ctx context.Context, app *argoappv1.Application, proj *arg unstructureds = append(unstructureds, obj) } groupedObjs := groupObjsByKey(unstructureds, liveObjs, app.Spec.Destination.Namespace) - items = groupObjsForDiff(resources, groupedObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace)) + items = groupObjsForDiff(resources, groupedObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace), app.Spec.Destination.Namespace) } else { for i := range resources.Items { res := resources.Items[i] @@ -1105,7 +1105,7 @@ func findandPrintDiff(ctx context.Context, app *argoappv1.Application, proj *arg return foundDiffs } -func groupObjsForDiff(resources *application.ManagedResourcesResponse, objs map[kube.ResourceKey]*unstructured.Unstructured, items []objKeyLiveTarget, argoSettings *settings.Settings, appName string) []objKeyLiveTarget { +func groupObjsForDiff(resources *application.ManagedResourcesResponse, objs map[kube.ResourceKey]*unstructured.Unstructured, items []objKeyLiveTarget, argoSettings *settings.Settings, appName, namespace string) []objKeyLiveTarget { resourceTracking := argo.NewResourceTracking() for _, res := range resources.Items { var live = &unstructured.Unstructured{} @@ -1120,7 +1120,7 @@ func groupObjsForDiff(resources *application.ManagedResourcesResponse, objs map[ } if local, ok := objs[key]; ok || live != nil { if local != nil && !kube.IsCRD(local) { - err = resourceTracking.SetAppInstance(local, argoSettings.AppLabelKey, appName, "", argoappv1.TrackingMethod(argoSettings.GetTrackingMethod())) + err = resourceTracking.SetAppInstance(local, argoSettings.AppLabelKey, appName, namespace, argoappv1.TrackingMethod(argoSettings.GetTrackingMethod())) errors.CheckError(err) } diff --git a/test/e2e/cluster_objects_test.go b/test/e2e/cluster_objects_test.go index 4388932296673..4299a35c55c00 100644 --- a/test/e2e/cluster_objects_test.go +++ b/test/e2e/cluster_objects_test.go @@ -5,12 +5,14 @@ import ( "github.com/argoproj/gitops-engine/pkg/health" . "github.com/argoproj/gitops-engine/pkg/sync/common" + "github.com/stretchr/testify/assert" . "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1" + . "github.com/argoproj/argo-cd/v2/test/e2e/fixture" . "github.com/argoproj/argo-cd/v2/test/e2e/fixture/app" + "github.com/argoproj/argo-cd/v2/util/argo" ) -// ensure that cluster scoped objects, like a cluster role, as a hok, can be successfully deployed func TestClusterRoleBinding(t *testing.T) { Given(t). Path("cluster-role"). @@ -20,5 +22,35 @@ func TestClusterRoleBinding(t *testing.T) { Then(). Expect(OperationPhaseIs(OperationSucceeded)). Expect(HealthIs(health.HealthStatusHealthy)). + Expect(SyncStatusIs(SyncStatusCodeSynced)). + And(func(app *Application) { + diffOutput, err := RunCli("app", "diff", app.Name, "--revision=HEAD") + assert.NoError(t, err) + assert.Empty(t, diffOutput) + }). + When(). + SetTrackingMethod(string(argo.TrackingMethodAnnotation)). + Sync(). + Then(). + Expect(OperationPhaseIs(OperationSucceeded)). + Expect(SyncStatusIs(SyncStatusCodeSynced)). + Expect(HealthIs(health.HealthStatusHealthy)). + And(func(app *Application) { + diffOutput, err := RunCli("app", "diff", app.Name, "--revision=HEAD") + assert.NoError(t, err) + assert.Empty(t, diffOutput) + }) +} + +// ensure that cluster scoped objects, like a cluster role, as a hook, can be successfully deployed +func TestClusterRoleBindingHook(t *testing.T) { + Given(t). + Path("cluster-role-hook"). + When(). + CreateApp(). + Sync(). + Then(). + Expect(OperationPhaseIs(OperationSucceeded)). + Expect(HealthIs(health.HealthStatusHealthy)). Expect(SyncStatusIs(SyncStatusCodeSynced)) } diff --git a/test/e2e/testdata/cluster-role-hook/cluster-role.yaml b/test/e2e/testdata/cluster-role-hook/cluster-role.yaml new file mode 100644 index 0000000000000..456e1b12fbd33 --- /dev/null +++ b/test/e2e/testdata/cluster-role-hook/cluster-role.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + namespace: cert-manager + name: my-cluster-role-binding + annotations: + argocd.argoproj.io/hook: PreSync +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: + - kind: ServiceAccount + name: default + namespace: default diff --git a/test/e2e/testdata/cluster-role/pod.yaml b/test/e2e/testdata/cluster-role-hook/pod.yaml similarity index 100% rename from test/e2e/testdata/cluster-role/pod.yaml rename to test/e2e/testdata/cluster-role-hook/pod.yaml diff --git a/test/e2e/testdata/cluster-role/cluster-role.yaml b/test/e2e/testdata/cluster-role/cluster-role.yaml index cb6cd7c1b3e42..cc5365bb3f4de 100644 --- a/test/e2e/testdata/cluster-role/cluster-role.yaml +++ b/test/e2e/testdata/cluster-role/cluster-role.yaml @@ -1,10 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - namespace: cert-manager name: my-cluster-role-binding - annotations: - argocd.argoproj.io/hook: PreSync roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12,4 +9,4 @@ roleRef: subjects: - kind: ServiceAccount name: default - namespace: default \ No newline at end of file + namespace: default From 0f107851d7e071b9515a0fbd78566e55b5254115 Mon Sep 17 00:00:00 2001 From: fsl <1171313930@qq.com> Date: Thu, 13 Jul 2023 01:49:32 +0800 Subject: [PATCH 15/17] chore(deps): bump library/golang from 1.20.5 to 1.20.6 (#14480) Signed-off-by: fengshunli <1171313930@qq.com> --- Dockerfile | 4 ++-- test/container/Dockerfile | 2 +- test/remote/Dockerfile | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index dbed21ca65bad..a35ad80d18dd5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:22.04@sha256:ac58ff7fe25edc58bdf0067ca99 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image # Also used as the image in CI jobs so needs all dependencies #################################################################################################### -FROM docker.io/library/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f AS builder +FROM docker.io/library/golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c AS builder RUN echo 'deb http://deb.debian.org/debian buster-backports main' >> /etc/apt/sources.list @@ -101,7 +101,7 @@ RUN HOST_ARCH=$TARGETARCH NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OP #################################################################################################### # Argo CD Build stage which performs the actual build of Argo CD binaries #################################################################################################### -FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f AS argocd-build +FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c AS argocd-build WORKDIR /go/src/github.com/argoproj/argo-cd diff --git a/test/container/Dockerfile b/test/container/Dockerfile index d6ae93e26884b..22b984dfa2633 100644 --- a/test/container/Dockerfile +++ b/test/container/Dockerfile @@ -8,7 +8,7 @@ RUN ln -s /usr/lib/$(uname -m)-linux-gnu /usr/lib/linux-gnu # Please make sure to also check the contained yarn version and update the references below when upgrading this image's version FROM docker.io/library/node:20.4.0@sha256:b3ca7d32f0c12291df6e45a914d4ee60011a3fce4a978df5e609e356a4a2cb88 as node -FROM docker.io/library/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f as golang +FROM docker.io/library/golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c as golang FROM docker.io/library/registry:2.8@sha256:41f413c22d6156587e2a51f3e80c09808b8c70e82be149b82b5e0196a88d49b4 as registry diff --git a/test/remote/Dockerfile b/test/remote/Dockerfile index effd69c9768af..9851825b58264 100644 --- a/test/remote/Dockerfile +++ b/test/remote/Dockerfile @@ -1,6 +1,6 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:22.04 -FROM docker.io/library/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f AS go +FROM docker.io/library/golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c AS go RUN go install github.com/mattn/goreman@latest && \ go install github.com/kisielk/godepgraph@latest From 927b940c3e455028fc6d830482fee8e840b36ff9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Jul 2023 23:16:55 +0000 Subject: [PATCH 16/17] chore(deps): bump github.com/aws/aws-sdk-go from 1.44.298 to 1.44.299 (#14468) Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.44.298 to 1.44.299. - [Release notes](https://github.com/aws/aws-sdk-go/releases) - [Commits](https://github.com/aws/aws-sdk-go/compare/v1.44.298...v1.44.299) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 94437d3427379..2a2db5c8a0390 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/argoproj/gitops-engine v0.7.1-0.20230607163028-425d65e07695 github.com/argoproj/notifications-engine v0.4.1-0.20230620204159-3446d4ae8520 github.com/argoproj/pkg v0.13.7-0.20230626144333-d56162821bd1 - github.com/aws/aws-sdk-go v1.44.298 + github.com/aws/aws-sdk-go v1.44.299 github.com/bmatcuk/doublestar/v4 v4.6.0 github.com/bombsimon/logrusr/v2 v2.0.1 github.com/bradleyfalzon/ghinstallation/v2 v2.5.0 diff --git a/go.sum b/go.sum index 9c1315e2d479c..3e1ffdd2e0128 100644 --- a/go.sum +++ b/go.sum @@ -716,8 +716,8 @@ github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN github.com/aws/aws-sdk-go v1.35.24/go.mod h1:tlPOdRjfxPBpNIwqDj61rmsnA85v9jc0Ps9+muhnW+k= github.com/aws/aws-sdk-go v1.38.49/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro= github.com/aws/aws-sdk-go v1.44.289/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= -github.com/aws/aws-sdk-go v1.44.298 h1:5qTxdubgV7PptZJmp/2qDwD2JL187ePL7VOxsSh1i3g= -github.com/aws/aws-sdk-go v1.44.298/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= +github.com/aws/aws-sdk-go v1.44.299 h1:HVD9lU4CAFHGxleMJp95FV/sRhtg7P4miHD1v88JAQk= +github.com/aws/aws-sdk-go v1.44.299/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g= github.com/beevik/ntp v0.2.0/go.mod h1:hIHWr+l3+/clUnF44zdK+CWW7fO8dR5cIylAQ76NRpg= github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM= From 0fd5a99f201d7b0be0a319a6f7e9cb7e9360b6ee Mon Sep 17 00:00:00 2001 From: Christian Hernandez Date: Thu, 13 Jul 2023 06:31:14 -0700 Subject: [PATCH 17/17] added instructions on how to delete a user (#14488) Signed-off-by: Christian Hernandez Co-authored-by: pasha-codefresh --- docs/operator-manual/user-management/index.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/operator-manual/user-management/index.md b/docs/operator-manual/user-management/index.md index 5bac93db92d06..1b3b96cd72104 100644 --- a/docs/operator-manual/user-management/index.md +++ b/docs/operator-manual/user-management/index.md @@ -44,6 +44,24 @@ Each user might have two capabilities: * apiKey - allows generating authentication tokens for API access * login - allows to login using UI +### Delete user + +In order to delete a user, you must remove the corresponding entry defined in the `argocd-cm` ConfigMap: + +Example: + +```bash +kubectl patch -n argocd cm argocd-cm --type='json' -p='[{"op": "remove", "path": "/data/accounts.alice"}]' +``` + +It is recommended to also remove the password entry in the `argocd-secret` Secret: + +Example: + +```bash +kubectl patch -n argocd secrets argocd-secret --type='json' -p='[{"op": "remove", "path": "/data/accounts.alice.password"}]' +``` + ### Disable admin user As soon as additional users are created it is recommended to disable `admin` user: