1949 matches found
CVE-2024-52814
CVE-2024-52814 — Helm (Argo) workflow-role privileges lack granularity : Affects Argo Helm prior to 0.45.0. The issue grants broad permissions in the workflow-role to all workflow Pods, not only those that require them, potentially impacting status reporting for certain Pods/Templates. Multiple s...
CVE-2024-52814 Helm Lacks Granularity in Workflow Role
Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...
CVE-2024-52814: Insufficient Granularity of Access Control
Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...
PT-2024-35462 · Argo Helm · Argo Helm
Name of the Vulnerable Software and Affected Versions: Argo Helm versions prior to 0.45.0 Description: The issue is related to the workflow-role lacking granularity in its privileges, giving unnecessary permissions to workflowtasksets and workflowartifactgctasks for all workflow Pods. This could...
Argo Helm 安全漏洞
Argo Helm is a community-maintained chartset open-sourced by the Argo Project. A security vulnerability exists in Argo Helm versions prior to 0.45.0 that stems from a lack of granularity in workflow-role permissions...
GO-2024-3280 Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher
Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
CVE-2024-52799 Argo Workflows Chart: Excessive Privileges in Workflow Role
Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...
CVE-2024-52799 Argo Workflows Chart: Excessive Privileges in Workflow Role
Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...
CVE-2024-52799 Argo Workflows Chart: Excessive Privileges in Workflow Role
Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...
CVE-2024-52799
Argo Workflows Chart (Helm) prior to 0.44.0 has a vulnerable workflow-role with excessive privileges, including create pods/exec, enabling kubectl exec into any Pod in the same namespace and potentially arbitrary code execution if a user runs a malicious template. Affected charts are those using ...
PT-2024-35450 · Unknown · Argo Workflows Chart
Name of the Vulnerable Software and Affected Versions: Argo Workflows Chart versions prior to 0.44.0 Description: The workflow-role in the Argo Workflows Chart has excessive privileges, including the ability to create pods/exec, which allows for arbitrary code execution within pods in the same...
Rancher Helm Applications may have sensitive values leaked
Impact A vulnerability has been identified within Rancher Manager whereby applications installed via Rancher Manager Apps Catalog store their Helm values directly into the Apps Custom Resource Definition, resulting in any users with GET access to it to be able to read any sensitive information th...
GHSA-9C5P-35GJ-JQP4 Rancher Helm Applications may have sensitive values leaked
Impact A vulnerability has been identified within Rancher Manager whereby applications installed via Rancher Manager Apps Catalog store their Helm values directly into the Apps Custom Resource Definition, resulting in any users with GET access to it to be able to read any sensitive information th...
PT-2024-35150 · Rancher · Rancher Manager
Name of the Vulnerable Software and Affected Versions: Rancher Manager versions prior to 2.8.10 Rancher Manager versions prior to 2.9.5 Description: A vulnerability has been identified in Rancher Manager where applications installed via the Apps Catalog store their Helm values directly into the...
Path Traversal
helm.sh/helm is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in chart archives, which allows files to be extracted outside the target directory when unpacking...
WS-2021-0121
When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged. A patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD. Anyone with access to the pod logs - either via acces...
Credentials Exposure
github.com/argoproj/argo-cd is vulnerable to Credentials Exposure. The vulnerability is due to the inappropriate handling and logging of sensitive authentication information within pod logs when connected to a Helm OCI repository with authentication enabled, allows individuals with access to the...
Malicious code in @fdp-tools/helm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bef4a02ea616732eda209303ce418b0fbf07d43995a8ac48bada7b7967f78819 The OpenSSF Package Analysis project identified '@fdp-tools/helm' @ 0.1.11 npm as malicious. It is considered malicious because: - The package...
MAL-2024-9106 Malicious code in @fdp-tools/helm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bef4a02ea616732eda209303ce418b0fbf07d43995a8ac48bada7b7967f78819 The OpenSSF Package Analysis project identified '@fdp-tools/helm' @ 0.1.11 npm as malicious. It is considered malicious because: - The package...