Security scan finds known vulnerability in ArgoCD v2.9.5 dependencies

[VladislavDubrovenski]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

• fixedVersion: 0.17.0
  installedVersion: v0.14.0
  lastModifiedDate: "2024-01-25T04:15:07Z"
  links: []
  primaryLink: https://avd.aquasec.com/nvd/cve-2023-48795
  publishedDate: "2023-12-18T16:15:10Z"
  resource: golang.org/x/crypto
  score: 5.9
  severity: MEDIUM
  target: ""
  title: 'ssh: Prefix truncation attack on Binary Packet Protocol (BPP)'
  vulnerabilityID: CVE-2023-48795

• fixedVersion: 0.17.0
  installedVersion: v0.16.0
  lastModifiedDate: "2024-01-25T04:15:07Z"
  links: []
  primaryLink: https://avd.aquasec.com/nvd/cve-2023-48795
  publishedDate: "2023-12-18T16:15:10Z"
  resource: golang.org/x/crypto
  score: 5.9
  severity: MEDIUM
  target: ""
  title: 'ssh: Prefix truncation attack on Binary Packet Protocol (BPP)'
  vulnerabilityID: CVE-2023-48795

To Reproduce

Aqua Trivy Scan

Expected behavior

Scanners don't flag this...

Version
2.9.5

[blakepettersson]

The new version of golang.org/x/crypto is in master with #16645.

As for cherry-picking it back to 2.9.x or 2.10.x, see this comment.