Open renovate[bot] opened 2 months ago
In order to perform the update(s) described in the table above, Renovate ran the go get
command, which resulted in the following additional change(s):
Details:
Package | Change |
---|---|
github.com/argoproj/gitops-engine |
v0.7.1-0.20240416142647-fbecbb86e412 -> v0.7.1-0.20240715141605-18ba62e1f1fb |
This PR contains the following updates:
v2.11.2
->v2.11.7
GitHub Vulnerability Alerts
CVE-2024-40634
Summary
This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.
Details
The webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case "X-GitHub-Event: push") that will make ArgoCD start allocating memory to parse the incoming request. Since the request can be constructed client-side without allocating large amounts of memory, it can be arbitrarily large. Eventually, the argocd-server component will get OOMKilled as it consumes all its available memory.
The fix would be to enforce a limit on the size of the request being parsed.
PoC
Port-forward to the argocd-server service, like so:
Run the below code:
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.6 v2.10.15 v2.9.20
For more information
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
Credits
This vulnerability was found & reported by Jakub Ciolek
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
CVE-2024-41666
Argo CD v2.11.3 and before, discovering that even if the user's
p, role:myrole, exec, create, */*, allow
permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access.Description
Argo CD has a Web-based terminal that allows you to get a shell inside a running pod, just like you would with kubectl exec. However, when the administrator enables this function and grants permission to the user
p, role:myrole, exec, create, */*, allow
, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. CVE-2023-40025 Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only userp, role:myrole, exec, create, */*, allow
permissions, which may still lead to the leakage of sensitive information.Patches
A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.7 v2.10.16 v2.9.21
For more information
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
Credits
This vulnerability was found & reported by Shengjie Li, Huazhong University of Science and Technology Zhi Li, Huazhong University of Science and Technology Weijie Liu, Nankai University
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
Release Notes
argoproj/argo-cd (github.com/argoproj/argo-cd/v2)
### [`v2.11.7`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.7) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.6...v2.11.7) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.7/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.7/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Other work - [`05edb2a`](https://redirect.github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476): feat: verify rbac on each message and not just during handshake ([@pasha-codefresh](https://redirect.github.com/pasha-codefresh)) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.6...v2.11.7 ### [`v2.11.6`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.6) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.5...v2.11.6) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.6/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.6/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Bug fixes - [`b980386`](https://redirect.github.com/argoproj/argo-cd/commit/b980386388230a0c04bdd9dd748472c1a7326c21): fix: cherry-pick [#18761](https://redirect.github.com/argoproj/argo-cd/issues/18761) (v2.11) ([#19108](https://redirect.github.com/argoproj/argo-cd/issues/19108)) ([@blakepettersson](https://redirect.github.com/blakepettersson)) ##### Other work - [`540e3a5`](https://redirect.github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36): Merge commit from fork ([@pasha-codefresh](https://redirect.github.com/pasha-codefresh)) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.5...v2.11.6 ### [`v2.11.5`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.5) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.4...v2.11.5) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.5/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.5/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Bug fixes - [`c0f780c`](https://redirect.github.com/argoproj/argo-cd/commit/c0f780c380fec80a9c29b0123c7237fb87037eb4): fix(cli): Get Redis password from secret in `loadClusters()` ([#18951](https://redirect.github.com/argoproj/argo-cd/issues/18951)) ([#18956](https://redirect.github.com/argoproj/argo-cd/issues/18956)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Other work - [`d1c052d`](https://redirect.github.com/argoproj/argo-cd/commit/d1c052d7bf5fd19d927f8d493d4948570a4773bc): chore: update gitops-engine (2.11) ([#19036](https://redirect.github.com/argoproj/argo-cd/issues/19036)) ([@agaudreault](https://redirect.github.com/agaudreault)) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.4...v2.11.5 ### [`v2.11.4`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.4) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.3...v2.11.4) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.4/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.4/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Features - [`d75b23b`](https://redirect.github.com/argoproj/argo-cd/commit/d75b23bf9260b01288bfb684c2843f93f7419372): Revert "feat(server): log app Spec along with event ([#16416](https://redirect.github.com/argoproj/argo-cd/issues/16416))" ([#18458](https://redirect.github.com/argoproj/argo-cd/issues/18458)) ([#18639](https://redirect.github.com/argoproj/argo-cd/issues/18639)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Bug fixes - [`24b198b`](https://redirect.github.com/argoproj/argo-cd/commit/24b198bf51c451534f1142f98046978f01bf5ce7): fix(appset): revert "keep reconciling even when params error occurred" ([#17062](https://redirect.github.com/argoproj/argo-cd/issues/17062)) ([#18781](https://redirect.github.com/argoproj/argo-cd/issues/18781)) ([@crenshaw-dev](https://redirect.github.com/crenshaw-dev)) - [`bfbceff`](https://redirect.github.com/argoproj/argo-cd/commit/bfbceff5da9d5fad76d347dd236f11379f026263): fix(controller): bad server-side diffs ([#18213](https://redirect.github.com/argoproj/argo-cd/issues/18213)) (2.11) ([#18868](https://redirect.github.com/argoproj/argo-cd/issues/18868)) ([@crenshaw-dev](https://redirect.github.com/crenshaw-dev)) - [`07880f3`](https://redirect.github.com/argoproj/argo-cd/commit/07880f3c1d3313f27922cdd693e5505d843387b0): fix(webhook): bitbucket and azure not triggering refresh ([#18289](https://redirect.github.com/argoproj/argo-cd/issues/18289)) ([#18765](https://redirect.github.com/argoproj/argo-cd/issues/18765)) ([#18819](https://redirect.github.com/argoproj/argo-cd/issues/18819)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) - [`b5c13b6`](https://redirect.github.com/argoproj/argo-cd/commit/b5c13b6139fb8de5c0901e489e30e139d245ef58): fix: Update braces package to 3.0.3 ([#18459](https://redirect.github.com/argoproj/argo-cd/issues/18459)) ([#18663](https://redirect.github.com/argoproj/argo-cd/issues/18663)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) - [`5fd645f`](https://redirect.github.com/argoproj/argo-cd/commit/5fd645feacd29196d0622061052d3fae4464ddb7): fix: docs site version selector broken ([#18378](https://redirect.github.com/argoproj/argo-cd/issues/18378)) ([#18724](https://redirect.github.com/argoproj/argo-cd/issues/18724)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) - [`0d1709f`](https://redirect.github.com/argoproj/argo-cd/commit/0d1709f73b26bf338e6cc29234c10f5fb69fd28b): fix: update static schemas ([#18889](https://redirect.github.com/argoproj/argo-cd/issues/18889)) ([@crenshaw-dev](https://redirect.github.com/crenshaw-dev)) ##### Documentation - [`0e71f09`](https://redirect.github.com/argoproj/argo-cd/commit/0e71f09990b8bbaeafc15ae5354caf732ecb9ea6): docs: Fix .path to .path.segments go template ([#18872](https://redirect.github.com/argoproj/argo-cd/issues/18872)) ([#18874](https://redirect.github.com/argoproj/argo-cd/issues/18874)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Dependency updates - [`c2bd38a`](https://redirect.github.com/argoproj/argo-cd/commit/c2bd38a11a3224b1f3d4be7e831980f72f64a5c2): chore(deps): upgrade redis to 7.2.15-alpine (cherry-pick release-2.11) ([#18640](https://redirect.github.com/argoproj/argo-cd/issues/18640)) ([@34fathombelow](https://redirect.github.com/34fathombelow)) ##### Other work - [`13844b9`](https://redirect.github.com/argoproj/argo-cd/commit/13844b90ad1a10334bdaac56402182b08eefe1fb): chore: bump go version to 1.21.10 ([#18540](https://redirect.github.com/argoproj/argo-cd/issues/18540)) ([@34fathombelow](https://redirect.github.com/34fathombelow)) - [`e1284e1`](https://redirect.github.com/argoproj/argo-cd/commit/e1284e19e03c9abab2ea55314b14b1e0381c4045): remove unwanted updating of source-position in app set command ([#18887](https://redirect.github.com/argoproj/argo-cd/issues/18887)) ([#18896](https://redirect.github.com/argoproj/argo-cd/issues/18896)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.3...v2.11.4 ### [`v2.11.3`](https://redirect.github.com/argoproj/argo-cd/releases/tag/v2.11.3) [Compare Source](https://redirect.github.com/argoproj/argo-cd/compare/v2.11.2...v2.11.3) #### Quick Start ##### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.3/manifests/install.yaml ``` ##### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.3/manifests/ha/install.yaml ``` #### Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. #### Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. #### Changelog ##### Bug fixes - [`46342a9`](https://redirect.github.com/argoproj/argo-cd/commit/46342a9e82f0ba53b996b1d4441301814d508e3f): fix: app names with non-alphanumeric characters in position 63 break syncs (issue [#18237](https://redirect.github.com/argoproj/argo-cd/issues/18237)) ([#18256](https://redirect.github.com/argoproj/argo-cd/issues/18256)) ([#18439](https://redirect.github.com/argoproj/argo-cd/issues/18439)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) ##### Other work - [`e01bb53`](https://redirect.github.com/argoproj/argo-cd/commit/e01bb5303ae664d5af0dc1560ce0b2f819494c12): Merge pull request from GHSA-3cqf-953p-h5cp ([@pasha-codefresh](https://redirect.github.com/pasha-codefresh)) - [`320abb8`](https://redirect.github.com/argoproj/argo-cd/commit/320abb8d649eecba86b1c8cc84e8a81df09b0b55): Merge pull request from GHSA-87p9-x75h-p4j2 ([@blakepettersson](https://redirect.github.com/blakepettersson)) - [`cf17283`](https://redirect.github.com/argoproj/argo-cd/commit/cf17283ebed196f44fa1bba38afe5a5cfdc18ee2): fix source ordering issue in manifest generation for multi-source app while using manifests and diff commands ([#18395](https://redirect.github.com/argoproj/argo-cd/issues/18395)) ([#18408](https://redirect.github.com/argoproj/argo-cd/issues/18408)) ([@gcp-cherry-pick-bot](https://redirect.github.com/gcp-cherry-pick-bot)\[bot]) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v2.11.2...v2.11.3Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.