8000 x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24904 · Issue #453 · golang/vulndb · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24904 #453

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
GoVulnBot opened this issue May 20, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24904 #453

GoVulnBot opened this issue May 20, 2022 · 3 comments
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

CVE-2022-24904 references github.com/argoproj/argo-cd, which may be a Go module.

Description:
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.

Links:

See doc/triage.md for instructions on how to triage this report.

module: github.com/argoproj/argo-cd
package: argo-cd
description: |
    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.
cves:
  - CVE-2022-24904
links:
    context:
      - https://github.com/argoproj/argo-cd/releases/tag/v2.1.15
      - https://github.com/argoproj/argo-cd/releases/tag/v2.2.9
      - https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
      - https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h
@neild
Copy link
Contributor
neild commented Jun 14, 2022

Vulnerability in tool.

@neild neild closed this as completed Jun 14, 2022
@neild neild added excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. and removed NotGoVuln labels Aug 10, 2022
This was referenced Jan 25, 2023
Closed
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Feb 8, 2023
Closed