GO-2024-3002 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd

Argo CD Unauthenticated Denial of Service DoS Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd...

GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd

The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to deficiencies in the authentication process when handling the final endpoint /api/v1/settings. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the ignoreDifferences configuration in the declarative delivery tool for GitOps for Kubernetes Argo CD allows a attacker to trigger a service failure.

The vulnerability of the ignoreDifferences configuration option in GitOps’ continuous delivery tool for Kubernetes Argo CD is related to an uncontrolled resource consumption when processing the jqPathExpressions parameter. Exploiting this vulnerability could allow a malicious actor to cause servi...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in the error reporting mechanism, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to shortcomings in the error reporting mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.12.5 security update

An update is now available for Red Hat OpenShift GitOps v1.12.5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.11.7 security update

An update is now available for Red Hat OpenShift GitOps v1.11.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2023-40025

A flaw was found in Argo CD. Affected versions of Argo CD have a bug where open web terminal sessions do not expire. This bug allows users to send WebSocket messages even if the token has expired. The most straightforward scenario occurs when a user opens the terminal view and leaves it open for ...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.13.1 security update

An update is now available for Red Hat OpenShift GitOps v1.13.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2024-41666

A vulnerability was found in ArgoCD's web-based terminal. This issue may allow a user to continue sending WebSocket messages and access sensitive information even after their p, role:myrole, exec, create, /, and allow permissions are revoked. The terminal session remains active as long as it is...

Information Disclosure

github.com/argoproj/argo-cd is vulnerable to Information Disclosure. The vulnerability is due to improper enforcement of permission revocation for open terminal sessions within websocket.go, which allows continued unauthorized access and the potential leakage of sensitive information even after...

The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, /, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access. Description Argo CD has ...

GHSA-V8WX-V5JQ-QHHW vulnerabilities

Vulnerabilities for packages: argo-cd-fips...

GHSA-V8WX-V5JQ-QHHW The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, /, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access. Description Argo CD has ...

CVE-2024-41666 vulnerabilities

Vulnerabilities for packages: argo-cd-fips...

CVE-2024-41666

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666

Argo CD's Web-based terminal vulnerability allows a user with permissions p, role:myrole, exec, create, / , allow to continue operations in the container even after revoking that permission, as long as the terminal view stays open. The issue can persist beyond token expiration/revocation and is n...