Path traversal and dereference of symlinks in Argo CD

Impact All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

New Argo CD Bug Could Let Hackers Steal Secret Info from Kubernetes Apps

Users of the Argo continuous deployment CD tool for Kubernetes are being urged to push through updates after a zero-day vulnerability was found that could allow an attacker to extract sensitive information such as passwords and API keys. The flaw, tagged as CVE-2022-24348 CVSS score: 7.7, affects...

CVE-2022-24348

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

CVE-2022-24348

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

Directory traversal

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

CVE-2022-24348

CVE-2022-24348 affects Argo CD prior to 2.1.9 and 2.2.x prior to 2.2.4 due to a path traversal in helmTemplate within repository.go. This weakness can allow an attacker with access to Helm charts to traverse directories and potentially read YAML files containing credentials, depending on chart co...

CVE-2022-24348

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

CVE-2022-24348

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

CVE-2022-24348

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

Argo CD Security Bug Opens Kubernetes Cloud Apps to Attackers

A high-severity security vulnerability in Argo CD can enable attackers to access targets’ application-development environments, paving the way for stealing passwords, API keys, tokens and other sensitive information. Argo CD is a continuous-delivery platform deployed as a Kubernetes controller in...

argo:fuzz_workflow_controller: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4815348191330304 Project: argo Fuzzing Engine: libFuzzer Fuzz Target: fuzzworkflowcontroller Job Type: libfuzzerasanargo Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00001c1df21e Crash State: NULL Sanitizer: address ASAN Recommend...

PT-2022-16632

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 2.1.9 Argo CD versions 2.2.x prior to 2.2.4 Description The issue allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. This could enable an attacker to discover...

CVE-2022-24348: Improper Limitation of a Pathname to a Restricted Directory

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file...

Argo CD path traversal vulnerability

Argo is an open source container native workflow engine. argo CD is vulnerable to a path traversal vulnerability that originates from an error in helmTemplate in repository.go, which can be exploited by an attacker to discover credentials stored in YAML files...

GHSA-VJ54-CJRX-X696 Observable Discrepancy in Argo

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. Specific Go Packages Affected...

Observable Discrepancy in Argo

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. Specific Go Packages Affected...

Observable Discrepancy

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

ffmpeg:ffmpeg_AV_CODEC_ID_ARGO_fuzzer: Heap-buffer-overflow in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4820016722214912 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDARGOfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address:...