x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-31016

[GoVulnBot]

CVE-2022-31016 references github.com/argoproj/argo-cd, which may be a Go module.

Description:
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.

Links:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-31016
• JSON: https://github.com/CVEProject/cvelist/tree/7d991e78a4126dd23dd511b113527be509b18209/2022/31xxx/CVE-2022-31016.json
• Imported by: https://pkg.go.dev/github.com/argoproj/argo-cd?tab=importedby
• GHSA-jhqp-vf4w-rpwq

See doc/triage.md for instructions on how to triage this report.

packages:
  - module: github.com/argoproj/argo-cd
    package: argo-cd
description: |
    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service,  resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file.  The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.
cves:
  - CVE-2022-31016
links:
    context:
      - https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq

[neild]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/607219 mentions this issue: data/reports: unexclude 20 reports (17)