Skip to content

x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2023-40584 #2050

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2023-40584#2050
Assignees
timothy-king
Labels
excluded: EFFECTIVELY_PRIVATEThis vulnerability exists in a package can be imported, but isn't meant to be outside that module.
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Sep 8, 2023

CVE-2023-40584 references github.com/argoproj/argo-cd, which may be a Go module.

Description:
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/argoproj/argo-cd
      vulnerable_at: 1.8.6
      packages:
        - package: argo-cd
description: |-
    Argo CD is a declarative continuous deployment for Kubernetes. All versions of
    ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is
    vulnerable to a Denial-of-Service attack vector. Specifically, the said
    component extracts a user-controlled tar.gz file without validating the size of
    its inner files. As a result, a malicious, low-privileged user can send a
    malicious tar.gz file that exploits this vulnerability to the repo-server,
    thereby harming the system's functionality and availability. Additionally, the
    repo-server is susceptible to another vulnerability due to the fact that it does
    not check the extracted file permissions before attempting to delete them.
    Consequently, an attacker can craft a malicious tar.gz archive in a way that
    prevents the deletion of its inner files when the manifest generation process is
    completed. A patch for this vulnerability has been released in versions 2.6.15,
    2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely
    resolve the issue is to upgrade, however users unable to upgrade should
    configure RBAC (Role-Based Access Control) and provide access for configuring
    applications only to a limited number of administrators. These administrators
    should utilize trusted and verified Helm charts.
cves:
    - CVE-2023-40584
references:
    - advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-g687-f2gx-6wm8
    - fix: https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674

Metadata

Metadata

Assignees

Labels

excluded: EFFECTIVELY_PRIVATEThis vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions