search

golang / vulndb

[mirror] The Go Vulnerability Database
Other
557 stars 56 forks source link

x/vulndb: potential Go vuln in github.com/argoproj/argo-cd/v2: GHSA-jmvp-698c-4x3w #3002

Closed GoVulnBot closed 1 month ago

GoVulnBot commented 1 month ago

Advisory GHSA-jmvp-698c-4x3w references a vulnerability in the following Go modules:

Module
github.com/argoproj/argo-cd
github.com/argoproj/argo-cd/v2

Description:

Summary

This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.

Details

The webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case "X-GitHub-Event: push") that will make Arg...

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/argoproj/argo-cd
      non_go_versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.0.0, <= 1.8.7")
      vulnerable_at: 1.8.6
    - module: github.com/argoproj/argo-cd/v2
      versions:
        - fixed: 2.9.20
        - introduced: 2.10.0
        - fixed: 2.10.15
        - introduced: 2.11.0
        - fixed: 2.11.6
      vulnerable_at: 2.11.5
summary: |-
    Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook
    Endpoint in github.com/argoproj/argo-cd
cves:
    - CVE-2024-40634
ghsas:
    - GHSA-jmvp-698c-4x3w
references:
    - advisory: https://github.com/advisories/GHSA-jmvp-698c-4x3w
    - advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3w
    - fix: https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc
    - fix: https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36
    - fix: https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4df
source:
    id: GHSA-jmvp-698c-4x3w
    created: 2024-07-22T18:01:16.422997048Z
review_status: UNREVIEWED
gopherbot commented 1 month ago

Change https://go.dev/cl/601384 mentions this issue: data/reports: add GO-2024-3002

gopherbot commented 1 month ago

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports