CVE-2022-31105

Argo CD versions 0.4.0–2.2.11, 2.3.6–2.4.5 are affected by an improper certificate validation when connecting to OIDC providers, risking trust in a malicious provider. Patches were released in 2.2.11, 2.3.6, and 2.4.5. Upgrading to these patched releases (or newer) is the recommended fix. A parti...

Argo CD certificate verification is skipped for connections to OIDC providers

Impact All versions of Argo CD starting with v0.4.0 are vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious or otherwise untrustworthy OIDC provider. Note: external OIDC provider support was added in v0.11.0. Before that version, the notes below app...

CVE-2022-31105 Argo CD's certificate verification is skipped for connections to OIDC providers

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious or otherwise untrustworthy OpenID Connect OIDC...

ArgoCD 信任管理问题漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in the Git repository, automatically synchronizing and deploying...

PT-2022-4053 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 0.4.0 through 2.2.10 Argo CD versions 2.3.0 through 2.3.5 Argo CD versions 2.4.0 through 2.4.4 Description: The issue is related to an improper certificate validation bug in Argo CD, which could cause it to trust a malicious...

Improper Certificate Validation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious or otherwise untrustworthy OpenID Connect OIDC...

Dell BSAFE Micro Edition Suite和Dell BSAFE 输入验证错误漏洞

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate and transport layer security for c/c applications, devices, systems, etc. Dell BSAFE is a security software product that supports encryption algorithms, certificate chain validation and transport layer...

Dell BSAFE 安全漏洞

Dell BSAFE Micro Edition Suite is a development toolkit that provides encryption, certificate, and transport layer security for c/c++ applications, devices, and systems.Dell BSAFE is a security software product that supports cryptographic algorithms, certificate chain validation, and Transport...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of...

Red Hat CloudForms Management Engine 信任管理问题漏洞

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure-as-a-Service cloud service solutions from Red Hat, USA. A security vulnerability exists in the Red Hat CloudForms Management Engine that stems from an insecure configuration of certificate validation...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to loss of confidentiality due to CVE-2022-32210

Summary Node.js module undici is used by IBM App Connect Enterprise Certified Container when testing API endpoints. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use the API testing capability may be vulnerable to loss of confidentiality if made to target an API...

GO-2022-0462 Improper validation of client certificates in github.com/pion/dtls/v2

Client-provided certificates are not correctly validated, and must not be trusted. DTLS client certificates must be accompanied by proof that the client possesses the private key for the certificate. The Pion DTLS server accepted client certificates unaccompanied by this proof, permitting an...

The vulnerability of Firefox browsers on Android, related to errors in the TLS certificate validation process, allows attackers to execute arbitrary code.

The vulnerability of Firefox browsers for Android is related to errors in the TLS certificate validation process. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2022-4980 · Dell · Dell Os10

Name of the Vulnerable Software and Affected Versions: Dell OS10 version 10.5.3.4 Description: The issue is related to an Improper Certificate Validation vulnerability in the Support Assist component. This could allow a remote unauthenticated attacker to exploit the vulnerability, leading to...

CVE-2022-31083

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

Authentication flaw

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

CVE-2022-31083 Authentication bypass in Parse Server Apple Game Center auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

CVE-2022-31083 Authentication bypass in Parse Server Apple Game Center auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

CVE-2022-31083

Parse Server vulnerability CVE-2022-31083 affects the Apple Game Center auth adapter. Prior to versions 4.10.11 and 5.2.2, the certificate in this adapter was not validated, potentially allowing authentication bypass by supplying a forged certificate via certain Apple domains and an authData URL....

CVE-2022-31083 Authentication bypass in Parse Server Apple Game Center auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...