CVE-2022-24817: Improper Control of Generation of Code

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

PT-2022-16897

Name of the Vulnerable Software and Affected Versions Flux2 versions 0.1.0 through 0.29.0 helm-controller versions 0.1.0 through 0.19.0 kustomize-controller versions 0.1.0 through 0.23.0 Description The issue concerns code injection via malicious Kubeconfig files, potentially leading to privilege...

Flux2 代码注入漏洞

Flux2 is a tool from the Cloud Native Computing Foundation to keep Kubernetes clusters synchronized with their configuration sources. A security vulnerability exists in Flux2 prior to v0.29.0, Flux2 helm-controller prior to v0.19.0, and Flux2 kustomize-controller prior to v0.23.0, which stems fro...

Exposure of repository credentials to external third-party sources in Rancher

Impact This issue only happens when the user configures access credentials to a private repository in Rancher inside Apps & Marketplace Repositories. It affects Rancher versions 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2. An insufficient check of the same-origin...

PT-2022-10549 · Suse · Suse Rancher

Name of the Vulnerable Software and Affected Versions: SUSE Rancher versions prior to 2.5.12 SUSE Rancher versions prior to 2.6.3 Description: The issue allows administrators of third-party repositories to gather credentials sent to their servers due to an incorrect authorization vulnerability...

GHSA-WM2R-RP98-8PMH Exposure of SSH credentials in Rancher/Fleet

Impact This vulnerability only affects customers using Fleet for continuous delivery with authenticated Git and/or Helm repositories. A security vulnerability CVE-2022-29810 was discovered in go-getter library in versions prior to v1.5.11 that exposes SSH private keys in base64 format due to a...

CVE-2021-32690 affecting package helm for versions less than 3.4.1-4

CVE-2021-32690 affecting package helm for versions less than 3.4.1-4. A patched version of the package is available...

CVE-2021-21303 affecting package helm for versions less than 3.4.1-4

CVE-2021-21303 affecting package helm for versions less than 3.4.1-4. A patched version of the package is available...

helm:fuzz_parse_message_block: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6501072115466240 Project: helm Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsemessageblock Job Type: libfuzzerasanhelm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision...

Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been...

Improper Access Control

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's...

CVE-2022-24731

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's...

PT-2022-6942 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.3.0 through 2.1.10 Argo CD versions 2.2.0 through 2.2.5 Argo CD versions 2.3.0 and earlier, excluding 2.3.0 itself as it is a fixed version Description: The issue is related to a path traversal bug compounded by an improper...

CVE-2022-24731: Improper Limitation of a Pathname to a Restricted Directory

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's...

PT-2022-6941 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.5.0 through 2.1.10 Argo CD versions 2.2.0 through 2.2.5 Argo CD versions 2.3.0 and earlier, excluding 2.3.0 Description: A path traversal vulnerability in Argo CD allows a malicious user with read/write access to leak...

CVE-2022-1025

A privilege escalation flaw was found in ArgoCD. This flaw allows a malicious user who has push access to an application's source git or Helm repository, or sync and override access, to perform actions they are not authorized to do. For example, if the attacker has update or delete access, they c...

GitHub argo-cd 访问控制错误漏洞

GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. GitHub argo-cd suffers from an Access Control Error vulnerability that stems from a path traversal flaw in ArgoCD. An attacker could exploit the vulnerability to craft a special...

ArgoCD 安全漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

helm:fuzz_download_index_file: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6520776096874496 Project: helm Fuzzing Engine: libFuzzer Fuzz Target: fuzzdownloadindexfile Job Type: libfuzzerasanhelm Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000010ac066e Crash State: NULL Sanitizer: address ASAN Recommende...

GHSA-63QX-X74G-JCR7 Path traversal and dereference of symlinks in Argo CD

Impact All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files...