x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: GHSA-6p4m-hw2h-6gmw

[GoVulnBot]

In GitHub Security Advisory GHSA-6p4m-hw2h-6gmw, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/argoproj/argo-cd	2.6.0-rc5	= 2.6.0-rc4

Cross references:

• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24348 #304 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24730 #357 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24731 #358 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24768 #359 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: GHSA-6w87-g839-9wv7 #387 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24904 #453 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24905 #454 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-29165 #455 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31016 #495 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31034 #497 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31035 #498 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31036 #499 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-1025 #516 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31102 #517 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31105 #518 EFFECTIVELY_PRIVATE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd/util/session: GHSA-vj54-cjrx-x696 #882 NOT_IMPORTABLE
• Module github.com/argoproj/argo-cd appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo-cd/util/cache: GHSA-xcqr-9h24-vrgw #892 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/argoproj/argo-cd
    versions:
      - introduced: TODO (earliest fixed "2.6.0-rc5", vuln range "= 2.6.0-rc4")
    packages:
      - package: github.com/argoproj/argo-cd
  - module: github.com/argoproj/argo-cd
    versions:
      - introduced: 2.5.0-rc1
        fixed: 2.5.8
    packages:
      - package: github.com/argoproj/argo-cd
description: "### Impact\n\nAll Argo CD versions starting with 2.5.0-rc1 are vulnerable
    to an authorization bypass bug which allows a malicious Argo CD user to deploy
    Applications outside the configured allowed namespaces. \n\n#### Description of
    exploit\n\nReconciled Application namespaces are specified as a comma-delimited
    list of glob patterns. When sharding is enabled on the Application controller,
    it does not enforce that list of patterns when reconciling Applications. For example,
    if Application namespaces are configured to be `argocd-*`, the Application controller
    may reconcile an Application installed in a namespace called `other`, even though
    it does not start with `argocd-`.\n\nReconciliation of the out-of-bounds Application
    is only triggered when the Application is updated, so the attacker must be able
    to cause an update operation on the Application resource.\n\n#### Limitations\n\nThis
    bug only applies to users who have explicitly enabled the \"apps-in-any-namespace\"
    feature by setting `application.namespaces` in the argocd-cmd-params-cm ConfigMap
    or otherwise setting the `--application-namespaces` flags on the Application controller
    and API server components. The apps-in-any-namespace feature is in beta as of
    this Security Advisory's publish date.\n\nThe bug is also limited to Argo CD instances
    where sharding is enabled by increasing the `replicas` count for the Application
    controller.\n\nFinally, the AppProjects' `sourceNamespaces` field acts as a secondary
    check against this exploit. To cause reconciliation of an Application in an out-of-bounds
    namespace, an AppProject must be available which permits Applications in the out-of-bounds
    namespace.\n\n### Patches\n\nA patch for this vulnerability has been released
    in the following Argo CD versions:\n\n* v2.5.8\n* v2.6.0-rc5\n\n### Workarounds\n\nRunning
    only one replica of the Application controller will prevent exploitation of this
    bug.\n\nMaking sure all AppProjects' `sourceNamespaces` are restricted within
    the confines of the configured Application namespaces will also prevent exploitation
    of this bug.\n\n### Credits\n\nThanks to ChangZhuo Chen (@czchen) for finding
    the issue and for contributing the fix!\n\n### References\n\n* [Documentation
    for apps-in-any-namespace](https://argo-cd--10678.org.readthedocs.build/en/10678/operator-manual/app-any-namespace/)\n\n###
    For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues)
    or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on
    [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\n"
cves:
  - CVE-2023-22736
ghsas:
  - GHSA-6p4m-hw2h-6gmw

[gopherbot]

Change https://go.dev/cl/466475 mentions this issue: data/excluded: batch add GO-2023-1527, GO-2023-1524, GO-2023-1516, GO-2023-1514, GO-2023-1513, GO-2023-1511, GO-2023-1523, GO-2023-1522, GO-2023-1520, GO-2023-1512

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606782 mentions this issue: data/reports: unexclude 20 reports (2)