938 matches found
Authorization
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud...
Authorization
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed...
CVE-2023-22736 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed...
CVE-2023-22736 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed...
CVE-2023-22736
CVE-2023-22736 affects Argo CD (GitOps for Kubernetes). Vulnerable when using versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and 2.6.0-rc4, with the apps-in-any-namespace feature enabled and sharding turned up (replicas increased) for the Application controller. The bug yields an aut...
CVE-2023-22736 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed...
JWT audience claim is not verified
Impact All versions of Argo CD starting with v1.8.2 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud audience claim in signed tokens. The value of that claim specifies the intended audiences of the token i.e. the servi...
GHSA-Q9HR-J4RF-8FJC JWT audience claim is not verified
Impact All versions of Argo CD starting with v1.8.2 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud audience claim in signed tokens. The value of that claim specifies the intended audiences of the token i.e. the servi...
Controller reconciles apps outside configured namespaces when sharding is enabled
Impact All Argo CD versions starting with 2.5.0-rc1 are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. Description of exploit Reconciled Application namespaces are specified as a comma-delimited lis...
GHSA-6P4M-HW2H-6GMW Controller reconciles apps outside configured namespaces when sharding is enabled
Impact All Argo CD versions starting with 2.5.0-rc1 are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. Description of exploit Reconciled Application namespaces are specified as a comma-delimited lis...
Internet Bug Bounty: Argo CD reconciles apps outside configured namespaces when sharding is enabled
An authorization bypass vulnerability was found in Argo CD versions 2.5.0-rc1 and later, allowing a malicious user to deploy applications outside of the configured allowed namespaces when sharding is enabled. The vulnerability was triggered when an application was updated, and the controller...
CVE-2023-22482
Argo CD is affected by CVE-2023-22482: an improper authorization issue caused by failure to validate the audience (aud) claim in OIDC-signed tokens. Affected versions are Argo CD v1.8.2 and later until just before patches: 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3. The root cause is that Argo CD veri...
CVE-2023-22482 JWT audience claim is not verified
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud...
CVE-2023-22482 JWT audience claim is not verified
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud...
CVE-2023-22482 JWT audience claim is not verified
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud...
ArgoCD 安全漏洞
ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g. configuration in the Git repository, automatically synchronizing and deploying...
Argo CD 安全漏洞
Argo is an open source container-native workflow engine.ArgoCD is an application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository,...
PT-2023-1338
Name of the Vulnerable Software and Affected Versions Argo CD versions 2.5.0-rc1 through 2.5.7 Argo CD version 2.6.0-rc4 Description The issue is related to an authorization bypass bug in Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. This bug allows a malicious Argo CD...
Critical: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5.2 security fixes and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.5.2 General Availability release images, which fix security issues and bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
The vulnerability of the application deployment automation tool in Kubernetes ArgoCD, related to errors in the certificate validation process, allows attackers to perform spear-phishing attacks.
The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...