Action not permitted
Modal body text goes here.
cve-2022-31036
Vulnerability from cvelistv5
▼ | URL | Tags | |
---|---|---|---|
security-advisories@github.com | https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd | Patch, Third Party Advisory | |
security-advisories@github.com | https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm | Mitigation, Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T07:03:40.299Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "argo-cd", "vendor": "argoproj", "versions": [ { "status": "affected", "version": "\u003e= 1.3.0, \u003c 2.1.16" }, { "status": "affected", "version": "\u003e= 2.2.0, \u003c 2.2.10" }, { "status": "affected", "version": "\u003e= 2.3.0, \u003c 2.3.5" }, { "status": "affected", "version": "\u003e= 2.4.0, \u003c 2.4.1" } ] } ], "descriptions": [ { "lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-27T19:15:16", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd" } ], "source": { "advisory": "GHSA-q4w5-4gq2-98vm", "discovery": "UNKNOWN" }, "title": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-31036", "STATE": "PUBLIC", "TITLE": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "argo-cd", "version": { "version_data": [ { "version_value": "\u003e= 1.3.0, \u003c 2.1.16" }, { "version_value": "\u003e= 2.2.0, \u003c 2.2.10" }, { "version_value": "\u003e= 2.3.0, \u003c 2.3.5" }, { "version_value": "\u003e= 2.4.0, \u003c 2.4.1" } ] } } ] }, "vendor_name": "argoproj" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-20: Improper Input Validation" } ] }, { "description": [ { "lang": "eng", "value": "CWE-61: UNIX Symbolic Link (Symlink) Following" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "refsource": "CONFIRM", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" }, { "name": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd", "refsource": "MISC", "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd" } ] }, "source": { "advisory": "GHSA-q4w5-4gq2-98vm", "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-31036", "datePublished": "2022-06-27T19:15:16", "dateReserved": "2022-05-18T00:00:00", "dateUpdated": "2024-08-03T07:03:40.299Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-31036\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-06-27T20:15:08.400\",\"lastModified\":\"2024-08-07T15:43:51.540\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround.\"},{\"lang\":\"es\",\"value\":\"Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Todas las versiones de Argo CD a partir de la v1.3.0, son vulnerables a un error de seguimiento de enlaces simb\u00f3licos que permite a un usuario malicioso con acceso de escritura al repositorio filtrar archivos YAML confidenciales del repo-servidor de Argo CD. Un usuario malicioso de CD Argo con acceso de escritura para un repositorio que es (o puede ser) usado en una aplicaci\u00f3n de tipo Helm puede cometer un enlace simb\u00f3lico que apunte a un archivo fuera de l\u00edmites. Si el archivo de destino es un archivo YAML v\u00e1lido, el atacante puede leer el contenido de ese archivo. Los archivos confidenciales que podr\u00edan filtrarse incluyen los archivos de manifiesto de los repositorios de fuentes de otras Aplicaciones (archivos potencialmente descifrados, si es usado un plugin de descifrado) o cualquier secreto con formato YAML que haya sido montado como archivo en el servidor de repositorios. Han sido publicados parches para esta vulnerabilidad en las siguientes versiones del CD de Argo: v2.4.1, v2.3.5, v2.2.10 y v2.1.16. Si est\u00e1 usando una versi\u00f3n posterior a v2.3.0 incluy\u00e9ndola, y no presenta ninguna aplicaci\u00f3n de tipo Helm, puede deshabilitar la herramienta de administraci\u00f3n de configuraci\u00f3n Helm como mitigaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-61\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3.0\",\"versionEndExcluding\":\"2.1.6\",\"matchCriteriaId\":\"1C72B9FC-239A-461A-86AA-D0A71BDDCD19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.2.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9C0C6B1-4452-4D12-B8F7-841DDF3BEA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBA1F528-543F-44EE-8FE3-322C9B002266\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:2.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4599BA0B-1F60-4F19-A746-4039A9883E95\"}]}]}],\"references\":[{\"url\":\"https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]}]}}" } }
rhsa-2022_5192
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.3.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. (CVE-2022-31034)\n\n* argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI (CVE-2022-31035)\n\n* argocd: vulnerable to an uncontrolled memory consumption bug (CVE-2022-31016)\n\n* argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access (CVE-2022-31036)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:5192", "url": "https://access.redhat.com/errata/RHSA-2022:5192" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5192.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T01:07:00+00:00", "generator": { "date": "2024-11-06T01:07:00+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:5192", "initial_release_date": "2022-06-24T20:13:56+00:00", "revision_history": [ { "date": "2022-06-24T20:13:56+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-24T20:13:56+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:07:00+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.3", "product": { "name": "Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.3::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.3.11-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.3.11-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.3.11-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.3.11-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.3.11-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.3.11-4" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.3.11-4" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31016", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096283" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD, which is vulnerable to an uncontrolled memory consumption bug. A crafted manifest file can lead the ArgoCD\u0027s repo-server component to crash, causing a denial of service. The attacker must be an authenticated user to exploit this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to an uncontrolled memory consumption bug", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31016" }, { "category": "external", "summary": "RHBZ#2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31016", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31016" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T20:13:56+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5192" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to an uncontrolled memory consumption bug" }, { "cve": "CVE-2022-31034", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096282" } ], "notes": [ { "category": "description", "text": "Several Single sign-on (SSO) vulnerabilities were found in ArgoCD when the login process is initiated via CLI or UI interfaces. The vulnerabilities are related to using insufficiently random value parameters during the login process. This flaw gives the attacker elevated privileges, including the possibility of administrative rights.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31034" }, { "category": "external", "summary": "RHBZ#2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31034", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31034" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T20:13:56+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5192" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI." }, { "cve": "CVE-2022-31035", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096278" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) flaw was found in ArgoCD. This flaw allows a malicious actor to trigger a Cross-site scripting (XSS) vulnerability by storing a link point to a javascript code in ArgoCD UI. A successful attack depends on a user clicking the malicious link and triggering the function available in the UI without the user\u0027s knowledge. The actions done by the malicious code will run with the same victim\u0027s level of access, including administrative privileges, if the victim has this level of permission.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31035" }, { "category": "external", "summary": "RHBZ#2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31035", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31035" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T20:13:56+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5192" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI" }, { "cve": "CVE-2022-31036", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096291" } ], "notes": [ { "category": "description", "text": "A symlink following vulnerability was found in ArgoCD. A malicious user with write access can commit a symlink pointing to a file outside the expected directories. Once the Helm-type application consumes this symlink, the attacker can read the content of the file referenced by the symbolic link, compromising the confidentiality of other projects under the same ArgoCD installation.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:6c8043e2061c4d6589dfbeb30d99260bf0bdcd7639015054683eaf288af11095_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:2705a2930cf7b73b4af7b2626b2380326f20ada60e98a4d7e3aee0de89a27d57_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:93a1cbe44b5009f700e85e2f5a88de0fc3d4f7a3fe30240456899ea5e097ac5b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:ac6776a3a10b7234b876ae79c9f8e2c40412f7279ee65fa8805c8184d266719e_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:df385ec48f934f910b16a3c05357002ed1744f6765b8ade3dc7ca3b40ba5d642_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:b3961cafdf0c02c12523cee1bca91539321c37da1efa066c07013ed2085da0e2_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31036" }, { "category": "external", "summary": "RHBZ#2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31036", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31036" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T20:13:56+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5192" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:e34286b0a47918cf61a627697c59fc7be35ffe4b9be484e6cf6e377ab20f0187_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access" } ] }
rhsa-2022_5187
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.3 on OpenShift 4.6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. (CVE-2022-31034)\n\n* argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI (CVE-2022-31035)\n\n* argocd: vulnerable to an uncontrolled memory consumption bug (CVE-2022-31016)\n\n* argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access (CVE-2022-31036)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:5187", "url": "https://access.redhat.com/errata/RHSA-2022:5187" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5187.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T01:06:17+00:00", "generator": { "date": "2024-11-06T01:06:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:5187", "initial_release_date": "2022-06-24T21:07:03+00:00", "revision_history": [ { "date": "2022-06-24T21:07:03+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-24T21:07:03+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:06:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.3", "product": { "name": "Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.3::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.3.12-1" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.3.12-1" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.3.12-1" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.3.12-1" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.3.12-1" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.3.12-1" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.3.12-1" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64 as a component of Red Hat OpenShift GitOps 1.3", "product_id": "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64", "relates_to_product_reference": "8Base-GitOps-1.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31016", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096283" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD, which is vulnerable to an uncontrolled memory consumption bug. A crafted manifest file can lead the ArgoCD\u0027s repo-server component to crash, causing a denial of service. The attacker must be an authenticated user to exploit this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to an uncontrolled memory consumption bug", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31016" }, { "category": "external", "summary": "RHBZ#2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31016", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31016" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T21:07:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5187" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to an uncontrolled memory consumption bug" }, { "cve": "CVE-2022-31034", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096282" } ], "notes": [ { "category": "description", "text": "Several Single sign-on (SSO) vulnerabilities were found in ArgoCD when the login process is initiated via CLI or UI interfaces. The vulnerabilities are related to using insufficiently random value parameters during the login process. This flaw gives the attacker elevated privileges, including the possibility of administrative rights.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31034" }, { "category": "external", "summary": "RHBZ#2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31034", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31034" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T21:07:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5187" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI." }, { "cve": "CVE-2022-31035", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096278" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) flaw was found in ArgoCD. This flaw allows a malicious actor to trigger a Cross-site scripting (XSS) vulnerability by storing a link point to a javascript code in ArgoCD UI. A successful attack depends on a user clicking the malicious link and triggering the function available in the UI without the user\u0027s knowledge. The actions done by the malicious code will run with the same victim\u0027s level of access, including administrative privileges, if the victim has this level of permission.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31035" }, { "category": "external", "summary": "RHBZ#2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31035", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31035" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T21:07:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5187" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI" }, { "cve": "CVE-2022-31036", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096291" } ], "notes": [ { "category": "description", "text": "A symlink following vulnerability was found in ArgoCD. A malicious user with write access can commit a symlink pointing to a file outside the expected directories. Once the Helm-type application consumes this symlink, the attacker can read the content of the file referenced by the symbolic link, compromising the confidentiality of other projects under the same ArgoCD installation.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "known_not_affected": [ "8Base-GitOps-1.3:openshift-gitops-1/applicationset-rhel8@sha256:5ff7ebaced7b03edf9042ec952ce078bb2cf043873c1371f70105b1dce51a2bc_amd64", "8Base-GitOps-1.3:openshift-gitops-1/dex-rhel8@sha256:b87ba9f816195e4c24a6f8ecc5018a1490f1f0558388a4229bc113e8e8212b4b_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-operator-bundle@sha256:d6406b5132eb96d3f8ff535cc88eb0c6d5c57baca7c345084848d0201b706aa2_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8-operator@sha256:127ad7e1cdee07bb03a65bd95605539d28eb15bed59af719d6c8df12136bac2d_amd64", "8Base-GitOps-1.3:openshift-gitops-1/gitops-rhel8@sha256:2b1097d6a0b11037504f693fc50c006b30b1a231c2d5d95072b7df8816292725_amd64", "8Base-GitOps-1.3:openshift-gitops-1/kam-delivery-rhel8@sha256:61b05cb351191e84427a20e3dcd0c08e9fef07a2782e7c857756b703257d8086_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31036" }, { "category": "external", "summary": "RHBZ#2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31036", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31036" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-24T21:07:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5187" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.3:openshift-gitops-1/argocd-rhel8@sha256:c50ef13adc2fca3db28b79214990933d32e177f811379f739a805d2b62f0ee97_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access" } ] }
rhsa-2022_5153
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.4.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. (CVE-2022-31034)\n\n* argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI (CVE-2022-31035)\n\n* argocd: vulnerable to an uncontrolled memory consumption bug (CVE-2022-31016)\n\n* argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access (CVE-2022-31036)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:5153", "url": "https://access.redhat.com/errata/RHSA-2022:5153" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5153.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T01:06:36+00:00", "generator": { "date": "2024-11-06T01:06:36+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:5153", "initial_release_date": "2022-06-27T12:42:55+00:00", "revision_history": [ { "date": "2022-06-27T12:42:55+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-27T12:42:55+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:06:36+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.4", "product": { "name": "Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.4::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.4.9-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.4.9-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.4.9-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.4.9-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.4.9-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.4.9-3" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.4.9-3" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64 as a component of Red Hat OpenShift GitOps 1.4", "product_id": "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64", "relates_to_product_reference": "8Base-GitOps-1.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31016", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096283" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD, which is vulnerable to an uncontrolled memory consumption bug. A crafted manifest file can lead the ArgoCD\u0027s repo-server component to crash, causing a denial of service. The attacker must be an authenticated user to exploit this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to an uncontrolled memory consumption bug", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31016" }, { "category": "external", "summary": "RHBZ#2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31016", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31016" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-27T12:42:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5153" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to an uncontrolled memory consumption bug" }, { "cve": "CVE-2022-31034", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096282" } ], "notes": [ { "category": "description", "text": "Several Single sign-on (SSO) vulnerabilities were found in ArgoCD when the login process is initiated via CLI or UI interfaces. The vulnerabilities are related to using insufficiently random value parameters during the login process. This flaw gives the attacker elevated privileges, including the possibility of administrative rights.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31034" }, { "category": "external", "summary": "RHBZ#2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31034", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31034" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-27T12:42:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5153" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI." }, { "cve": "CVE-2022-31035", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096278" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) flaw was found in ArgoCD. This flaw allows a malicious actor to trigger a Cross-site scripting (XSS) vulnerability by storing a link point to a javascript code in ArgoCD UI. A successful attack depends on a user clicking the malicious link and triggering the function available in the UI without the user\u0027s knowledge. The actions done by the malicious code will run with the same victim\u0027s level of access, including administrative privileges, if the victim has this level of permission.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31035" }, { "category": "external", "summary": "RHBZ#2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31035", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31035" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-27T12:42:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5153" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI" }, { "cve": "CVE-2022-31036", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096291" } ], "notes": [ { "category": "description", "text": "A symlink following vulnerability was found in ArgoCD. A malicious user with write access can commit a symlink pointing to a file outside the expected directories. Once the Helm-type application consumes this symlink, the attacker can read the content of the file referenced by the symbolic link, compromising the confidentiality of other projects under the same ArgoCD installation.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "known_not_affected": [ "8Base-GitOps-1.4:openshift-gitops-1/applicationset-rhel8@sha256:374aa562f7af0db1c11766dc2b0e5dd4a76549fee1de40508ea597a0d60ed73b_amd64", "8Base-GitOps-1.4:openshift-gitops-1/dex-rhel8@sha256:c9aad6e71e7065524dd22dc292ae0f2109d261f5725a26f5a659d7fdb983976c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-operator-bundle@sha256:d20149f6061e14edf0214ef2da7018eeb8c90b53d04ce3951429391391e59556_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8-operator@sha256:d6f784052a3d27884d5b8b5f6cb9f9ac653a0ecf8aa25212345030c3d30ddeba_amd64", "8Base-GitOps-1.4:openshift-gitops-1/gitops-rhel8@sha256:1226d32dfdd148450802a938830a7f1306aa2a78a2e0ce0ff712408511f5f55c_amd64", "8Base-GitOps-1.4:openshift-gitops-1/kam-delivery-rhel8@sha256:70e6fad8c61c08777893e3dc3bbaf3ba4416314bd5e7a6e5436bf25fd2d1b110_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31036" }, { "category": "external", "summary": "RHBZ#2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31036", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31036" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-27T12:42:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5153" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.4:openshift-gitops-1/argocd-rhel8@sha256:7ee44440267be3c3d435b8097fb612bf5dd6fe0cc17ecfe0ca0bbf9bd136ca25_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access" } ] }
rhsa-2022_5152
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift GitOps 1.5.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.\n\nSecurity Fix(es):\n\n* argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. (CVE-2022-31034)\n\n* argocd: cross-site scripting (XSS) allows a malicious user to inject a javascript link in the UI (CVE-2022-31035)\n\n* argocd: vulnerable to an uncontrolled memory consumption bug (CVE-2022-31016)\n\n* argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access (CVE-2022-31036)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:5152", "url": "https://access.redhat.com/errata/RHSA-2022:5152" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5152.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift GitOps security update", "tracking": { "current_release_date": "2024-11-06T01:05:22+00:00", "generator": { "date": "2024-11-06T01:05:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:5152", "initial_release_date": "2022-06-22T04:17:42+00:00", "revision_history": [ { "date": "2022-06-22T04:17:42+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-22T04:17:42+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:05:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift GitOps 1.5", "product": { "name": "Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_gitops:1.5::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift GitOps" }, { "branches": [ { "category": "product_version", "name": "openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "product": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "product_id": "openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "product_identification_helper": { "purl": "pkg:oci/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/applicationset-rhel8\u0026tag=v1.5.3-2" } } }, { "category": "product_version", "name": "openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64", "product": { "name": "openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64", "product_id": "openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64", "product_identification_helper": { "purl": "pkg:oci/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel8\u0026tag=v1.5.3-2" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "product_id": "openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8\u0026tag=v1.5.3-2" } } }, { "category": "product_version", "name": "openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "product": { "name": "openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "product_id": "openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "product_identification_helper": { "purl": "pkg:oci/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel8\u0026tag=v1.5.3-2" } } }, { "category": "product_version", "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64", "product": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64", "product_id": "openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64", "product_identification_helper": { "purl": "pkg:oci/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/kam-delivery-rhel8\u0026tag=v1.5.3-2" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "product": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "product_id": "openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-operator-bundle\u0026tag=v1.5.3-2" } } }, { "category": "product_version", "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "product": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "product_id": "openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "product_identification_helper": { "purl": "pkg:oci/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator\u0026tag=v1.5.3-2" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64" }, "product_reference": "openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" }, "product_reference": "openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64" }, "product_reference": "openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64" }, "product_reference": "openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64" }, "product_reference": "openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64 as a component of Red Hat OpenShift GitOps 1.5", "product_id": "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" }, "product_reference": "openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64", "relates_to_product_reference": "8Base-GitOps-1.5" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31016", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096283" } ], "notes": [ { "category": "description", "text": "A flaw was found in ArgoCD, which is vulnerable to an uncontrolled memory consumption bug. A crafted manifest file can lead the ArgoCD\u0027s repo-server component to crash, causing a denial of service. The attacker must be an authenticated user to exploit this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to an uncontrolled memory consumption bug", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "known_not_affected": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31016" }, { "category": "external", "summary": "RHBZ#2096283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096283" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31016", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31016" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31016" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-22T04:17:42+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5152" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to an uncontrolled memory consumption bug" }, { "cve": "CVE-2022-31034", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096282" } ], "notes": [ { "category": "description", "text": "Several Single sign-on (SSO) vulnerabilities were found in ArgoCD when the login process is initiated via CLI or UI interfaces. The vulnerabilities are related to using insufficiently random value parameters during the login process. This flaw gives the attacker elevated privileges, including the possibility of administrative rights.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "known_not_affected": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31034" }, { "category": "external", "summary": "RHBZ#2096282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096282" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31034", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31034" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31034" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-22T04:17:42+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5152" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI." }, { "cve": "CVE-2022-31035", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096278" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) flaw was found in ArgoCD. This flaw allows a malicious actor to trigger a Cross-site scripting (XSS) vulnerability by storing a link point to a javascript code in ArgoCD UI. A successful attack depends on a user clicking the malicious link and triggering the function available in the UI without the user\u0027s knowledge. The actions done by the malicious code will run with the same victim\u0027s level of access, including administrative privileges, if the victim has this level of permission.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "known_not_affected": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31035" }, { "category": "external", "summary": "RHBZ#2096278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096278" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31035", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31035" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31035" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-22T04:17:42+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5152" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI" }, { "cve": "CVE-2022-31036", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "discovery_date": "2022-06-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2096291" } ], "notes": [ { "category": "description", "text": "A symlink following vulnerability was found in ArgoCD. A malicious user with write access can commit a symlink pointing to a file outside the expected directories. Once the Helm-type application consumes this symlink, the attacker can read the content of the file referenced by the symbolic link, compromising the confidentiality of other projects under the same ArgoCD installation.", "title": "Vulnerability description" }, { "category": "summary", "text": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "known_not_affected": [ "8Base-GitOps-1.5:openshift-gitops-1/applicationset-rhel8@sha256:c32cac230ef60e253043ba90232e6a920fe31197cd8cd2b1a3e541c84164cb35_amd64", "8Base-GitOps-1.5:openshift-gitops-1/dex-rhel8@sha256:3f8f609c488d05bea419632ec86f5a83c1fb611bf88e7c931e755a4893efa027_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-operator-bundle@sha256:2e0f97c28dcfadc2c754a2297939c29742ad0e61ecda56f315c5d85d6283ac51_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8-operator@sha256:cfc34d0e2602de2c9585a0d7c02e86cb45790ec84f0f90cedc40f684b83bd3e3_amd64", "8Base-GitOps-1.5:openshift-gitops-1/gitops-rhel8@sha256:2dd15519967981129832c3e3e96ac9683c0157aecb5e313b2318ff240b603436_amd64", "8Base-GitOps-1.5:openshift-gitops-1/kam-delivery-rhel8@sha256:fa82c04304f176057c18218c35dd80a7bd8b3dcb651af36ff8392993a8b0a259_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31036" }, { "category": "external", "summary": "RHBZ#2096291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31036", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31036" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036" }, { "category": "external", "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" } ], "release_date": "2022-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-22T04:17:42+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:5152" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-GitOps-1.5:openshift-gitops-1/argocd-rhel8@sha256:4974bab59e181b13139d0e3d9539f6b0fa7b984aeb2561409b1dad0da28d983b_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access" } ] }
gsd-2022-31036
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-31036", "description": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround.", "id": "GSD-2022-31036", "references": [ "https://access.redhat.com/errata/RHSA-2022:5152", "https://access.redhat.com/errata/RHSA-2022:5187", "https://access.redhat.com/errata/RHSA-2022:5192", "https://access.redhat.com/errata/RHSA-2022:5153" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-31036" ], "details": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround.", "id": "GSD-2022-31036", "modified": "2023-12-13T01:19:17.498483Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-31036", "STATE": "PUBLIC", "TITLE": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "argo-cd", "version": { "version_data": [ { "version_value": "\u003e= 1.3.0, \u003c 2.1.16" }, { "version_value": "\u003e= 2.2.0, \u003c 2.2.10" }, { "version_value": "\u003e= 2.3.0, \u003c 2.3.5" }, { "version_value": "\u003e= 2.4.0, \u003c 2.4.1" } ] } } ] }, "vendor_name": "argoproj" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-20: Improper Input Validation" } ] }, { "description": [ { "lang": "eng", "value": "CWE-61: UNIX Symbolic Link (Symlink) Following" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "refsource": "CONFIRM", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" }, { "name": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd", "refsource": "MISC", "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd" } ] }, "source": { "advisory": "GHSA-q4w5-4gq2-98vm", "discovery": "UNKNOWN" } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003e=v1.3.0 \u003c=v1.8.7", "affected_versions": "All versions starting from 1.3.0 up to 1.8.7", "cwe_ids": [ "CWE-1035", "CWE-937" ], "date": "2022-06-21", "description": "### Impact\n\nAll unpatched versions of Argo CD starting with v1.3.0 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server.\n\nA malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.\n\nSensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n### Workarounds\n\n* If you are using \u003e=v2.3.0 and do not have any Helm-type Applications, [disable the Helm config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools).\n\n#### Mitigations\n\n* Avoid mounting YAML-formatted secrets as files on the repo-server.\n* Upgrade to \u003e=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.\n\n#### Best practices which can mitigate risk\n\n* Limit who has push access to manifest repositories.\n* Limit who is allowed to configure new source repositories.\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### References\n\n* List of [types of Applications](https://argo-cd.readthedocs.io/en/stable/user-guide/application_sources/), including Helm-type\n* [RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/), showing how to limit repository permissions\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n", "fixed_versions": [ "v2.1.16" ], "identifier": "GMS-2022-2557", "identifiers": [ "GHSA-q4w5-4gq2-98vm", "GMS-2022-2557", "CVE-2022-31036" ], "not_impacted": "All versions before 1.3.0, all versions after 1.8.7", "package_slug": "go/github.com/argoproj/argo-cd", "pubdate": "2022-06-21", "solution": "Upgrade to version 2.1.16 or above.", "title": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server", "urls": [ "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "https://github.com/advisories/GHSA-q4w5-4gq2-98vm" ], "uuid": "5a2b98a3-a81a-43a6-904c-74752edd11c1", "versions": [ { "commit": { "sha": "9f8608c9fcb2a1d8dcc06eeadd57e5c0334c5800", "tags": [ "v1.3.0" ], "timestamp": "20191113010324" }, "number": "v1.3.0" }, { "commit": { "sha": "eb3d1fb84b9b77cdffd70b14c4f949f1c64a9416", "tags": [ "v1.8.7" ], "timestamp": "20210303070237" }, "number": "v1.8.7" }, { "commit": { "sha": "903db5fe464032bd5a10bf32fe17639e76634c2a", "tags": [ "v2.1.16" ], "timestamp": "20220621161926" }, "number": "v2.1.16" } ] }, { "affected_range": "\u003cv2.1.16 || \u003e=v2.2.0 \u003cv2.2.10 || \u003e=v2.3.0 \u003cv2.3.5 || =v2.4.0", "affected_versions": "All versions before 2.1.16, all versions starting from 2.2.0 before 2.2.10, all versions starting from 2.3.0 before 2.3.5, version 2.4.0", "cwe_ids": [ "CWE-1035", "CWE-937" ], "date": "2022-06-21", "description": "### Impact\n\nAll unpatched versions of Argo CD starting with v1.3.0 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server.\n\nA malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.\n\nSensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n### Workarounds\n\n* If you are using \u003e=v2.3.0 and do not have any Helm-type Applications, [disable the Helm config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools).\n\n#### Mitigations\n\n* Avoid mounting YAML-formatted secrets as files on the repo-server.\n* Upgrade to \u003e=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.\n\n#### Best practices which can mitigate risk\n\n* Limit who has push access to manifest repositories.\n* Limit who is allowed to configure new source repositories.\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### References\n\n* List of [types of Applications](https://argo-cd.readthedocs.io/en/stable/user-guide/application_sources/), including Helm-type\n* [RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/), showing how to limit repository permissions\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n", "fixed_versions": [ "v2.1.16", "v2.2.10", "v2.3.5", "v2.4.1" ], "identifier": "GMS-2022-2561", "identifiers": [ "GHSA-q4w5-4gq2-98vm", "GMS-2022-2561", "CVE-2022-31036" ], "not_impacted": "All versions starting from 2.1.16 before 2.2.0, all versions starting from 2.2.10 before 2.3.0, all versions starting from 2.3.5 before 2.4.0, all versions after 2.4.0", "package_slug": "go/github.com/argoproj/argo-cd/v2", "pubdate": "2022-06-21", "solution": "Upgrade to versions 2.1.16, 2.2.10, 2.3.5, 2.4.1 or above.", "title": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server", "urls": [ "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "https://github.com/advisories/GHSA-q4w5-4gq2-98vm" ], "uuid": "6e2ebecd-366a-41a8-874d-c2f116e5ee29", "versions": [ { "commit": { "sha": "6da92a8e8103ce4145bb0fe2b7e952be79c9ff0a", "tags": [ "v2.2.0" ], "timestamp": "20211214180104" }, "number": "v2.2.0" }, { "commit": { "sha": "fe427802293b090f43f91f5839393174df6c3b3a", "tags": [ "v2.3.0" ], "timestamp": "20220306061859" }, "number": "v2.3.0" }, { "commit": { "sha": "91aefabc5b213a258ddcfe04b8e69bb4a2dd2566", "tags": [ "stable", "v2.4.0" ], "timestamp": "20220610171343" }, "number": "v2.4.0" }, { "commit": { "sha": "903db5fe464032bd5a10bf32fe17639e76634c2a", "tags": [ "v2.1.16" ], "timestamp": "20220621161926" }, "number": "v2.1.16" }, { "commit": { "sha": "8db0e57b738ff5b0b276031573576fdc3498c04f", "tags": [ "v2.2.10" ], "timestamp": "20220621162737" }, "number": "v2.2.10" }, { "commit": { "sha": "52e6025f8b565705025d029e8bed36d6caa5ecf7", "tags": [ "v2.4.1" ], "timestamp": "20220621162747" }, "number": "v2.4.1" }, { "commit": { "sha": "1287d24bfe47bcaa6e791e5ff12fa1c1bf57a442", "tags": [ "v2.3.5" ], "timestamp": "20220621162823" }, "number": "v2.3.5" } ] } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.3.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:2.2.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.1.6", "versionStartIncluding": "1.3.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-31036" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version \u003e=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-59" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd" }, { "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm", "refsource": "CONFIRM", "tags": [ "Mitigation", "Third Party Advisory" ], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 1.4 } }, "lastModifiedDate": "2022-07-07T17:24Z", "publishedDate": "2022-06-27T20:15Z" } } }
ghsa-q4w5-4gq2-98vm
Vulnerability from github
Impact
All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server.
A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.
Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
- v2.4.1
- v2.3.5
- v2.2.10
- v2.1.16
Workarounds
- If you are using >=v2.3.0 and do not have any Helm-type Applications, disable the Helm config management tool.
Mitigations
- Avoid mounting YAML-formatted secrets as files on the repo-server.
- Upgrade to >=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.
Best practices which can mitigate risk
- Limit who has push access to manifest repositories.
- Limit who is allowed to configure new source repositories.
Credits
Disclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.
References
- List of types of Applications, including Helm-type
- RBAC documentation, showing how to limit repository permissions
For more information
- Open an issue in the Argo CD issue tracker or discussions
- Join us on Slack in channel #argo-cd
{ "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 1.8.7" }, "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd" }, "ranges": [ { "events": [ { "introduced": "1.3.0" }, { "fixed": "2.1.16" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd/v2" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.1.16" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd/v2" }, "ranges": [ { "events": [ { "introduced": "2.2.0" }, { "fixed": "2.2.10" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd/v2" }, "ranges": [ { "events": [ { "introduced": "2.3.0" }, { "fixed": "2.3.5" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "github.com/argoproj/argo-cd/v2" }, "ranges": [ { "events": [ { "introduced": "2.4.0" }, { "fixed": "2.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.4.0" ] } ], "aliases": [ "CVE-2022-31036" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-59" ], "github_reviewed": true, "github_reviewed_at": "2022-06-21T20:04:51Z", "nvd_published_at": "2022-06-27T20:15:00Z", "severity": "MODERATE" }, "details": "### Impact\n\nAll unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server.\n\nA malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.\n\nSensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n### Workarounds\n\n* If you are using \u003e=v2.3.0 and do not have any Helm-type Applications, [disable the Helm config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools).\n\n#### Mitigations\n\n* Avoid mounting YAML-formatted secrets as files on the repo-server.\n* Upgrade to \u003e=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.\n\n#### Best practices which can mitigate risk\n\n* Limit who has push access to manifest repositories.\n* Limit who is allowed to configure new source repositories.\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### References\n\n* List of [types of Applications](https://argo-cd.readthedocs.io/en/stable/user-guide/application_sources/), including Helm-type\n* [RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/), showing how to limit repository permissions\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n", "id": "GHSA-q4w5-4gq2-98vm", "modified": "2022-06-21T20:04:51Z", "published": "2022-06-21T20:04:51Z", "references": [ { "type": "WEB", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036" }, { "type": "WEB", "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd" }, { "type": "PACKAGE", "url": "https://github.com/argoproj/argo-cd" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server" }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.