767 matches found
WS-2021-0217
An issue was found in github.com/argoproj/argo-workflows Go package up to 3.0.0 including. Users running using the Argo Server with --auth-mode=server which is the default v3.0.0 AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g...
WS-2021-0351
Vulnerable versions of argo-workflows are 3.0.0 through 3.0.8, and 3.1.0 through 3.1.5. Fixed in versions 3.0.9 and 3.1.6 of argo-workflows by removing client private key from client auth REST config. The client's authentication will be ignored and the server's authentication will be used. This...
WS-2021-0352
Vulnerable versions of argo-workflows are 3.0.0 through 3.0.8, and 3.1.0 through 3.1.5. Fixed in versions 3.0.9 and 3.1.6 of argo-workflows by generating TLS Certificates on startup and only keep in memory. The Argo Server's keys are packaged within the image. They could be extracted and used to...
SUSE CVE-2024-47827
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
GO-2024-3226 Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows...
BIT-ARGO-WORKFLOWS-2024-47827
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
GHSA-GHJW-32XW-FFWR Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Summary Due to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This was resolved by https://github.com/argoproj/argo-workflows/pull/13641 Details These two lines introduce a data race in the...
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Summary Due to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This was resolved by https://github.com/argoproj/argo-workflows/pull/13641 Details These two lines introduce a data race in the...
CVE-2024-47827
A flaw was found in Argo Workflows. Due to a race condition in a global variable, the Argo Workflows controller can crash on command by any user with access to execute a workflow, which can lead to a denial of service...
CVE-2024-47827
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
CVE-2024-47827
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
CVE-2024-47827
CVE-2024-47827 affects Argo Workflows (controller) where a race condition in a global variable in the 3.6.0-rc1 release can cause the controller to crash when a user with workflow execution access triggers a run. The issue is fixed in 3.6.0-rc2. Affected product: Argo Workflows (Kubernetes). Root...
CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
CVE-2024-47827: Concurrent Execution using Shared Resource with Improper Synchronization
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...
Argo Workflows 安全漏洞
Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. A security vulnerability exists in Argo Workflows version 3.6.0-rc1, which stems from a race condition in a global variable that allows any user authorized to execute workflows to crash the arg...
PT-2024-32838
Name of the Vulnerable Software and Affected Versions Argo Workflows version 3.6.0-rc1 Description Due to a race condition in a global variable, the Argo Workflows controller can be made to crash on-command by any user with access to execute a workflow. This issue can be exploited by creating and...
