Action not permitted
Modal body text goes here.
cve-2022-24731
Vulnerability from cvelistv5
▼ | URL | Tags | |
---|---|---|---|
security-advisories@github.com | https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28 | Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T04:20:50.444Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "argo-cd", "vendor": "argoproj", "versions": [ { "status": "affected", "version": "\u003e= 1.5.0, \u003c 2.1.11" }, { "status": "affected", "version": "\u003e= 2.2.0, \u003c 2.2.6" }, { "status": "affected", "version": "\u003e= 2.3.0-rc1, \u003c 2.3.0" } ] } ], "descriptions": [ { "lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-23T21:00:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28" } ], "source": { "advisory": "GHSA-h6h5-6fmq-rh28", "discovery": "UNKNOWN" }, "title": "Path traversal allows leaking out-of-bound files from Argo CD repo-server", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24731", "STATE": "PUBLIC", "TITLE": "Path traversal allows leaking out-of-bound files from Argo CD repo-server" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "argo-cd", "version": { "version_data": [ { "version_value": "\u003e= 1.5.0, \u003c 2.1.11" }, { "version_value": "\u003e= 2.2.0, \u003c 2.2.6" }, { "version_value": "\u003e= 2.3.0-rc1, \u003c 2.3.0" } ] } } ] }, "vendor_name": "argoproj" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" } ] }, { "description": [ { "lang": "eng", "value": "CWE-284: Improper Access Control" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28", "refsource": "CONFIRM", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28" } ] }, "source": { "advisory": "GHSA-h6h5-6fmq-rh28", "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24731", "datePublished": "2022-03-23T21:00:14", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.444Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-24731\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-03-23T21:15:08.083\",\"lastModified\":\"2024-08-07T15:43:51.540\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications.\"},{\"lang\":\"es\",\"value\":\"Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Argo CD a partir de la versi\u00f3n 1.5.0 pero antes de las versiones 2.1.11, 2.2.6 y 2.3.0 es susceptible a una vulnerabilidad de salto de ruta, que permite a un usuario malicioso con acceso de lectura/escritura filtrar archivos confidenciales desde el repo-servidor de Argo CD. Un usuario malicioso de Argo CD al que le haya sido concedido acceso \\\"create\\\" o \\\"update\\\" aplicaciones puede filtrar el contenido de cualquier archivo de texto en el servidor de repositorios. Al dise\u00f1ando un gr\u00e1fico Helm malicioso y us\u00e1ndolo en una Aplicaci\u00f3n, el atacante puede recuperar el contenido del archivo confidencial como parte de los manifiestos generados o en un mensaje de error. El atacante tendr\u00eda que conocer o adivinar la ubicaci\u00f3n del archivo objetivo. Los archivos confidenciales que podr\u00edan filtrarse incluyen archivos de los repositorios de origen de otra aplicaci\u00f3n o cualquier secreto que haya sido montado como archivo en el servidor de repositorios. Esta vulnerabilidad est\u00e1 parcheada en las versiones 2.1.11, 2.2.6 y 2.3.0 de Argo CD. El problema puede ser mitigado al evitar almacenar secretos en git, evitando montar secretos como archivos en el servidor de repo, evitando descifrar secretos en archivos en el servidor de repo, y limitando cuidadosamente qui\u00e9n puede \\\"create\\\" o \\\"update\\\" Aplicaciones\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.3,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"},{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.5.0\",\"versionEndExcluding\":\"2.1.11\",\"matchCriteriaId\":\"33244919-0218-4927-8E76-6059BB9909A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.2.0\",\"versionEndExcluding\":\"2.2.6\",\"matchCriteriaId\":\"3BF852EA-7214-413B-9E72-DFB0165067B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FA0E90D-79C0-4F34-8FB5-061073BCEEA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"794935A2-5EF6-4514-9B2B-D06AF10B2EA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"401CAF1A-8BCC-446F-8C4D-53753BAC8BDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"FBD86381-9064-4D50-B740-81E6680C6131\"}]}]}],\"references\":[{\"url\":\"https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2022_1040
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.3\n\nOpenShift GitOps v1.3.5 for OCP 4.6\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* Openshift-Gitops: Improper access control allows admin privilege escalation (CVE-2022-1025)\n\n* argocd: path traversal and improper access control allows leaking out-of-bound files (CVE-2022-24730)\n\n* argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:1040", "url": "https://access.redhat.com/errata/RHSA-2022:1040" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1040.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T00:36:42+00:00", "generator": { "date": "2024-11-06T00:36:42+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:1040", "initial_release_date": "2022-03-23T21:17:24+00:00", "revision_history": [ { "date": "2022-03-23T21:17:24+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-03-23T21:17:24+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T00:36:42+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.3", "product": { "name": "Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.3::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.3.5-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.3.5-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.3.5-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.3.5-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.3.5-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.3.5-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.3.5-4" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-1025", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2022-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2064682" } ], "notes": [ { "category": "description", "text": "A privilege escalation flaw was found in ArgoCD. This flaw allows a malicious user who has push access to an application\u0027s source git or Helm repository, or sync and override access, to perform actions they are not authorized to do. \r\n\r\nFor example, if the attacker has `update` or `delete` access, they can modify or delete any resource on the destination cluster and escalate ArgoCD privileges to the admin level. If the attacker has `get` access, they can view and list actions for any resource on the destination cluster except secrets and view the logs of any pods on the destination cluster. If the attacker has action/{some action or *} access on the application, they can run an action for any resource that supports the allowed action on the application\u0027s destination cluster.", "title": "Vulnerability description" }, { "category": "summary", "text": "Openshift-Gitops: Improper access control allows admin privilege escalation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1025" }, { "category": "external", "summary": "RHBZ#2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1025", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1025" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:17:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1040" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Openshift-Gitops: Improper access control allows admin privilege escalation" }, { "cve": "CVE-2022-24730", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062751" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD. This flaw allows an attacker with read-only repository access to leak files from the repo server that the attacker should not have access to. An attacker can send a crafted request to retrieve file contents. This issue results in the disclosure of sensitive information to an unauthorized actor and compromises data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal and improper access control allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24730" }, { "category": "external", "summary": "RHBZ#2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24730", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24730" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:17:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1040" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal and improper access control allows leaking out-of-bound files" }, { "cve": "CVE-2022-24731", "cwe": { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062755" } ], "notes": [ { "category": "description", "text": "A path traversal flaw was found in ArgoCD. This flaw allows an attacker who has been granted create or update access to applications to leak the contents of any text file on the repo-server by crafting a malicious Helm chart. Such text files could include sensitive information that the attacker should not have access to, compromising data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:8657efb2f6b32a4756735444a9604fae703ee8557d715523bb4a45937d3cfb64_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:8b0597884cbe0f0cfa4f997bacffa1257640f6ec0508709c277f420b91c77dcc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:98d5cfa73f1fa925cf9581613427a34f9077103189ae5125a62b7213ff92c16f_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:b839e60eef40851450d39f9718f843310c1cc86310ca0781716824dc79ac1c67_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:5ab8d41cd75bf7103f2c42e6aa2db0d2d19a2a01675cc3b1219db1b8dc55ecd0_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:4ad5448b0bf1fe1b445d04bc0feefe2ce82944709fc750cb1c0a6bb61722d52d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24731" }, { "category": "external", "summary": "RHBZ#2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24731", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24731" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:17:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1040" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:845ddc4f9d3a5e546a4ed37a544339cb74b2a1ab3b03f338129c7900028074ad_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal allows leaking out-of-bound files" } ] }
rhsa-2022_1041
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.4\n\nOpenShift GitOps v1.4.4\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* Openshift-Gitops: Improper access control allows admin privilege escalation\n(CVE-2022-1025)\n\n* argocd: path traversal and improper access control allows leaking out-of-bound\nfiles (CVE-2022-24730)\n\n* argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:1041", "url": "https://access.redhat.com/errata/RHSA-2022:1041" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1041.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T00:36:28+00:00", "generator": { "date": "2024-11-06T00:36:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:1041", "initial_release_date": "2022-03-23T21:18:40+00:00", "revision_history": [ { "date": "2022-03-23T21:18:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-03-23T21:18:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T00:36:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.4", "product": { "name": "Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.4::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.4.4-6" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.4.4-6" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.4.4-6" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.4.4-6" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.4.4-6" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.4.4-6" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.4.4-6" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-1025", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2022-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2064682" } ], "notes": [ { "category": "description", "text": "A privilege escalation flaw was found in ArgoCD. This flaw allows a malicious user who has push access to an application\u0027s source git or Helm repository, or sync and override access, to perform actions they are not authorized to do. \r\n\r\nFor example, if the attacker has `update` or `delete` access, they can modify or delete any resource on the destination cluster and escalate ArgoCD privileges to the admin level. If the attacker has `get` access, they can view and list actions for any resource on the destination cluster except secrets and view the logs of any pods on the destination cluster. If the attacker has action/{some action or *} access on the application, they can run an action for any resource that supports the allowed action on the application\u0027s destination cluster.", "title": "Vulnerability description" }, { "category": "summary", "text": "Openshift-Gitops: Improper access control allows admin privilege escalation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1025" }, { "category": "external", "summary": "RHBZ#2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1025", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1025" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:18:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Openshift-Gitops: Improper access control allows admin privilege escalation" }, { "cve": "CVE-2022-24730", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062751" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD. This flaw allows an attacker with read-only repository access to leak files from the repo server that the attacker should not have access to. An attacker can send a crafted request to retrieve file contents. This issue results in the disclosure of sensitive information to an unauthorized actor and compromises data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal and improper access control allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24730" }, { "category": "external", "summary": "RHBZ#2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24730", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24730" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:18:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal and improper access control allows leaking out-of-bound files" }, { "cve": "CVE-2022-24731", "cwe": { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062755" } ], "notes": [ { "category": "description", "text": "A path traversal flaw was found in ArgoCD. This flaw allows an attacker who has been granted create or update access to applications to leak the contents of any text file on the repo-server by crafting a malicious Helm chart. Such text files could include sensitive information that the attacker should not have access to, compromising data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:c966963a6444c314ae25f344ccc3f1cf95d8eed3ec51731e17d51686c92a6faa_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c731e153854c9ecf632e6a5eece55a1a9784d6f207dcab8da68af3ecdc636dc6_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:b745066a11639980442b4ed17067ba9463cf6bd8811e01941de22df8fee0ccac_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:8d97f916c4e10491db8387ce94c377d130afab47dcb3785cec394ffb5725e6f5_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:82c195a46b3f617e50f128a9726d0caab289b2a29bf274d283a2a50bc3f4c0f1_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:e70509ea9ebe8f5b5a267059ec5cef8d143a7c511ea1c65e2aaab68e38f9c3f1_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24731" }, { "category": "external", "summary": "RHBZ#2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24731", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24731" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:18:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:28dfb790f234e8819c7641971956a08e8c7167d6fe8d61594bb952eb5ca84ab1_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal allows leaking out-of-bound files" } ] }
rhsa-2022_1039
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift-gitops-applicationset-container, openshift-gitops-container, openshift-gitops-kam-delivery-container, and openshift-gitops-operator-container is now available for Red Hat OpenShift GitOps 1.2. (GitOps v1.2.3)\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* Openshift-Gitops: Improper access control allows admin privilege escalation (CVE-2022-1025)\n\n* argocd: path traversal and improper access control allows leaking out-of-bound files (CVE-2022-24730)\n\n* argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:1039", "url": "https://access.redhat.com/errata/RHSA-2022:1039" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1039.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T00:36:35+00:00", "generator": { "date": "2024-11-06T00:36:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:1039", "initial_release_date": "2022-03-23T21:19:59+00:00", "revision_history": [ { "date": "2022-03-23T21:19:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-03-23T21:19:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T00:36:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.2", "product": { "name": "Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.2::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.2.3-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.2.3-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.2.3-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.2.3-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.2.3-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.2.3-3" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64 as a component of Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "relates_to_product_reference": "8Base-GitOps-1.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64 as a component of Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64", "relates_to_product_reference": "8Base-GitOps-1.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64 as a component of Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "relates_to_product_reference": "8Base-GitOps-1.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64 as a component of Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "relates_to_product_reference": "8Base-GitOps-1.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64 as a component of Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "relates_to_product_reference": "8Base-GitOps-1.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64 as a component of Red Hat OpenShift GitOps 1.2", "product_id": "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64", "relates_to_product_reference": "8Base-GitOps-1.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-1025", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2022-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2064682" } ], "notes": [ { "category": "description", "text": "A privilege escalation flaw was found in ArgoCD. This flaw allows a malicious user who has push access to an application\u0027s source git or Helm repository, or sync and override access, to perform actions they are not authorized to do. \r\n\r\nFor example, if the attacker has `update` or `delete` access, they can modify or delete any resource on the destination cluster and escalate ArgoCD privileges to the admin level. If the attacker has `get` access, they can view and list actions for any resource on the destination cluster except secrets and view the logs of any pods on the destination cluster. If the attacker has action/{some action or *} access on the application, they can run an action for any resource that supports the allowed action on the application\u0027s destination cluster.", "title": "Vulnerability description" }, { "category": "summary", "text": "Openshift-Gitops: Improper access control allows admin privilege escalation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ], "known_not_affected": [ "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1025" }, { "category": "external", "summary": "RHBZ#2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1025", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1025" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:19:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1039" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Openshift-Gitops: Improper access control allows admin privilege escalation" }, { "cve": "CVE-2022-24730", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062751" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD. This flaw allows an attacker with read-only repository access to leak files from the repo server that the attacker should not have access to. An attacker can send a crafted request to retrieve file contents. This issue results in the disclosure of sensitive information to an unauthorized actor and compromises data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal and improper access control allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ], "known_not_affected": [ "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24730" }, { "category": "external", "summary": "RHBZ#2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24730", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24730" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:19:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1039" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal and improper access control allows leaking out-of-bound files" }, { "cve": "CVE-2022-24731", "cwe": { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062755" } ], "notes": [ { "category": "description", "text": "A path traversal flaw was found in ArgoCD. This flaw allows an attacker who has been granted create or update access to applications to leak the contents of any text file on the repo-server by crafting a malicious Helm chart. Such text files could include sensitive information that the attacker should not have access to, compromising data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ], "known_not_affected": [ "8Base-GitOps-1.2:openshift-gitops-1/applicationset-rhel8@sha256:e49c75d1232404c64e6a61d5ffed3ed4850d8309fa8a0d17c66d59f4bdadce8e_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-operator-bundle@sha256:57c0b68364294a996bd7faae39c302cb0e127737a33352af0c7841bd4768fe0b_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8-operator@sha256:1dbc15afdf7f21dc78bd554987deab3ee0e61154ce0902a2f47bffdd20610eae_amd64", "8Base-GitOps-1.2:openshift-gitops-1/gitops-rhel8@sha256:8eb80ce4bf7e74bce7b63f88c78d95b5641a8e323c43fbbc1dbeea13630a5d3f_amd64", "8Base-GitOps-1.2:openshift-gitops-1/kam-delivery-rhel8@sha256:c0ba402582511a6a0469eea64e8c483b954aef5e00cca01117161e465871c74e_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24731" }, { "category": "external", "summary": "RHBZ#2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24731", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24731" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:19:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1039" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.2:openshift-gitops-1/argocd-rhel8@sha256:e2f2749885671968d301a18952cc44269779775f40bd31cde210ade6b3cb6937_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal allows leaking out-of-bound files" } ] }
rhsa-2022_1042
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.3\n\nOpenShift GitOps v1.3.6 for OCP 4.7+\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* Openshift-Gitops: Improper access control allows admin privilege escalation\n(CVE-2022-1025)\n\n* argocd: path traversal and improper access control allows leaking out-of-bound\nfiles (CVE-2022-24730)\n\n* argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:1042", "url": "https://access.redhat.com/errata/RHSA-2022:1042" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1042.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T00:36:35+00:00", "generator": { "date": "2024-11-06T00:36:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:1042", "initial_release_date": "2022-03-23T21:53:20+00:00", "revision_history": [ { "date": "2022-03-23T21:53:20+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-03-23T21:53:20+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T00:36:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.3", "product": { "name": "Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.3::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.3.6-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.3.6-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.3.6-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.3.6-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.3.6-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.3.6-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.3.6-3" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-1025", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2022-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2064682" } ], "notes": [ { "category": "description", "text": "A privilege escalation flaw was found in ArgoCD. This flaw allows a malicious user who has push access to an application\u0027s source git or Helm repository, or sync and override access, to perform actions they are not authorized to do. \r\n\r\nFor example, if the attacker has `update` or `delete` access, they can modify or delete any resource on the destination cluster and escalate ArgoCD privileges to the admin level. If the attacker has `get` access, they can view and list actions for any resource on the destination cluster except secrets and view the logs of any pods on the destination cluster. If the attacker has action/{some action or *} access on the application, they can run an action for any resource that supports the allowed action on the application\u0027s destination cluster.", "title": "Vulnerability description" }, { "category": "summary", "text": "Openshift-Gitops: Improper access control allows admin privilege escalation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1025" }, { "category": "external", "summary": "RHBZ#2064682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1025", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1025" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:53:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1042" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Openshift-Gitops: Improper access control allows admin privilege escalation" }, { "cve": "CVE-2022-24730", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062751" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD. This flaw allows an attacker with read-only repository access to leak files from the repo server that the attacker should not have access to. An attacker can send a crafted request to retrieve file contents. This issue results in the disclosure of sensitive information to an unauthorized actor and compromises data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal and improper access control allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24730" }, { "category": "external", "summary": "RHBZ#2062751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062751" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24730", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24730" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24730" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:53:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1042" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal and improper access control allows leaking out-of-bound files" }, { "cve": "CVE-2022-24731", "cwe": { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information" }, "discovery_date": "2022-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2062755" } ], "notes": [ { "category": "description", "text": "A path traversal flaw was found in ArgoCD. This flaw allows an attacker who has been granted create or update access to applications to leak the contents of any text file on the repo-server by crafting a malicious Helm chart. Such text files could include sensitive information that the attacker should not have access to, compromising data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: path traversal allows leaking out-of-bound files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:f965937f6050138fa288b25b0111c518ff836c543e61da5a8a24c575a663c94b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:d8026dc27343a2db9871a5f3091eda1e7296bfb695ec73c4e528f660bc97f217_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:298334efb11a7ae3bbefa376070e13c8a295fbb302eb9ccdcebfc67739257c26_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:413581a8e996ffa0b579533844a42feb23bb9fe7324fec8051cbde7739b4c9ce_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:db788008a70be455c1d45c0d31590c947e2875b5b87fb0019d192bdb2a205bb6_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:8db428b93736c09230253726b89c27cee9628a7e2b0dd87a093f20c4875d86cb_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24731" }, { "category": "external", "summary": "RHBZ#2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24731", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24731" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731" } ], "release_date": "2022-03-22T17:15:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-03-23T21:53:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:1042" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:91e6b1300ddb1fc127cf90435e77dd0680b231baa34950d85bc80723a834f911_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: path traversal allows leaking out-of-bound files" } ] }
gsd-2022-24731
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-24731", "description": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications.", "id": "GSD-2022-24731", "references": [ "https://access.redhat.com/errata/RHSA-2022:1039", "https://access.redhat.com/errata/RHSA-2022:1040", "https://access.redhat.com/errata/RHSA-2022:1041", "https://access.redhat.com/errata/RHSA-2022:1042" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-24731" ], "details": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications.", "id": "GSD-2022-24731", "modified": "2023-12-13T01:19:42.884411Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24731", "STATE": "PUBLIC", "TITLE": "Path traversal allows leaking out-of-bound files from Argo CD repo-server" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "argo-cd", "version": { "version_data": [ { "version_value": "\u003e= 1.5.0, \u003c 2.1.11" }, { "version_value": "\u003e= 2.2.0, \u003c 2.2.6" }, { "version_value": "\u003e= 2.3.0-rc1, \u003c 2.3.0" } ] } } ] }, "vendor_name": "argoproj" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" } ] }, { "description": [ { "lang": "eng", "value": "CWE-284: Improper Access Control" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28", "refsource": "CONFIRM", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28" } ] }, "source": { "advisory": "GHSA-h6h5-6fmq-rh28", "discovery": "UNKNOWN" } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003e=v1.5.0 \u003cv2.1.11 || \u003e=v2.2.0 \u003cv2.2.6 || \u003e=v2.3.0-rc1 \u003cv2.3.0", "affected_versions": "All versions starting from 1.5.0 before 2.1.11, all versions starting from 2.2.0 before 2.2.6, all versions starting from 2.3.0-rc1 before 2.3.0", "cwe_ids": [ "CWE-1035", "CWE-22", "CWE-284", "CWE-352", "CWE-937" ], "date": "2022-03-29", "description": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications.", "fixed_versions": [ "v2.1.11", "v2.2.6", "v2.3.0" ], "identifier": "CVE-2022-24731", "identifiers": [ "GHSA-h6h5-6fmq-rh28", "CVE-2022-24731" ], "not_impacted": "All versions before 1.5.0, all versions starting from 2.1.11 before 2.2.0, all versions starting from 2.2.6 before 2.3.0-rc1, all versions starting from 2.3.0", "package_slug": "go/github.com/argoproj/argo-cd", "pubdate": "2022-03-24", "solution": "Upgrade to versions 2.1.11, 2.2.6, 2.3.0 or above.", "title": "Improper Access Control", "urls": [ "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28", "https://nvd.nist.gov/vuln/detail/CVE-2022-24731", "https://github.com/advisories/GHSA-h6h5-6fmq-rh28" ], "uuid": "5a40c5f9-7cca-4794-b604-8d80f17cc909", "versions": [ { "commit": { "sha": "bdda41046378a855e289b5f1602d5c923a3f914a", "tags": [ "v1.5.0" ], "timestamp": "20200402163443" }, "number": "v1.5.0" }, { "commit": { "sha": "6da92a8e8103ce4145bb0fe2b7e952be79c9ff0a", "tags": [ "v2.2.0" ], "timestamp": "20211214180104" }, "number": "v2.2.0" }, { "commit": { "sha": "7d7eed49329197207e5b86420780696bfc8c9ca9", "tags": [ "v2.3.0-rc1" ], "timestamp": "20220130214254" }, "number": "v2.3.0-rc1" }, { "commit": { "sha": "e25d3b54354dc529a11a1ccbb19f6338aa027525", "tags": [ "v2.1.11" ], "timestamp": "20220306053033" }, "number": "v2.1.11" }, { "commit": { "sha": "2e550c3f0723daf94df7343b7c40f459aafd6fff", "tags": [ "v2.2.6" ], "timestamp": "20220306055051" }, "number": "v2.2.6" }, { "commit": { "sha": "fe427802293b090f43f91f5839393174df6c3b3a", "tags": [ "v2.3.0" ], "timestamp": "20220306061859" }, "number": "v2.3.0" } ] } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.1.11", "versionStartIncluding": "1.5.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.2.6", "versionStartIncluding": "2.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.3.0:rc1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.3.0:rc2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.3.0:rc4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.3.0:rc5:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24731" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application\u0027s source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-22" }, { "lang": "en", "value": "CWE-209" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.2, "impactScore": 3.6 } }, "lastModifiedDate": "2022-04-01T14:03Z", "publishedDate": "2022-03-23T21:15Z" } } }
ghsa-h6h5-6fmq-rh28
Vulnerability from github
Impact
All unpatched versions of Argo CD starting with v1.5.0 are vulnerable to a path traversal vulnerability allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server.
A malicious Argo CD user who has been granted create
or update
access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file.
Sensitive files which could be leaked include files from other Application's source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
- v2.3.0
- v2.2.6
- v2.1.11
Workarounds
The only certain way to avoid the vulnerability is to upgrade.
To mitigate the problem, you can
* avoid storing secrets in git
* avoid mounting secrets as files on the repo-server
* avoid decrypting secrets into files on the repo-server
* carefully limit who can create
or update
Applications
References
For more information
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
{ "affected": [ { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd" }, "ranges": [ { "events": [ { "introduced": "1.5.0" }, { "fixed": "2.1.11" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd" }, "ranges": [ { "events": [ { "introduced": "2.2.0" }, { "fixed": "2.2.6" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd" }, "ranges": [ { "events": [ { "introduced": "2.3.0-rc1" }, { "fixed": "2.3.0" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-24731" ], "database_specific": { "cwe_ids": [ "CWE-209", "CWE-22", "CWE-284" ], "github_reviewed": true, "github_reviewed_at": "2022-03-24T00:12:46Z", "nvd_published_at": "2022-03-23T21:15:00Z", "severity": "MODERATE" }, "details": "### Impact\n\nAll unpatched versions of Argo CD starting with v1.5.0 are vulnerable to a path traversal vulnerability allowing a malicious user with read/write access to leak sensitive files from Argo CD\u0027s repo-server.\n\nA malicious Argo CD user who has been granted [`create` or `update` access to Applications](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file\u0027s contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file.\n\nSensitive files which could be leaked include files from other Application\u0027s source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.3.0\n* v2.2.6\n* v2.1.11\n\n### Workarounds\n\nThe only certain way to avoid the vulnerability is to upgrade. \n\nTo mitigate the problem, you can \n* avoid storing secrets in git\n* avoid mounting secrets as files on the repo-server\n* avoid decrypting secrets into files on the repo-server\n* carefully [limit who can `create` or `update` Applications](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions)\n\n### References\n\n* [Security documentation for the repo-server component](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#git-helm-repositories)\n* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)\n\n### For more information\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n", "id": "GHSA-h6h5-6fmq-rh28", "modified": "2022-03-24T00:12:46Z", "published": "2022-03-24T00:12:46Z", "references": [ { "type": "WEB", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24731" }, { "type": "PACKAGE", "url": "https://github.com/argoproj/argo-cd" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Path traversal allows leaking out-of-bound files from Argo CD repo-server" }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.