Linux Foundation Argo Continuous Delivery
By the Year
In 2024 there have been 0 vulnerabilities in Linux Foundation Argo Continuous Delivery . Last year Argo Continuous Delivery had 3 security vulnerabilities published. Right now, Argo Continuous Delivery is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 3 | 7.53 |
| 2022 | 0 | 0.00 |
| 2021 | 3 | 5.60 |
| 2020 | 5 | 7.12 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Argo Continuous Delivery vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Linux Foundation Argo Continuous Delivery Security Vulnerabilities
Argo CD is a declarative continuous deployment for Kubernetes
CVE-2023-40584
6.5 - Medium
- September 07, 2023
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.
Resource Exhaustion
Argo CD is a declarative continuous deployment for Kubernetes
CVE-2023-40029
9.6 - Critical
- September 07, 2023
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. **Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive. The bug has been patched in versions 2.8.3, 2.7.14, and 2.6.15. Users are advised to upgrade. Users unable to upgrade should update/deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl.kubernetes.io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.
Insertion of Sensitive Information into Log File
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2023-25163
6.5 - Medium
- February 08, 2023
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error. The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. If the user has `repositories, update` access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway. A patch for this vulnerability has been released in version 2.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Insertion of Sensitive Information into Log File
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD
CVE-2021-23135
5.5 - Medium
- May 12, 2021
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.
Generation of Error Message Containing Sensitive Information
The package github.com/argoproj/argo-cd/cmd before 1.7.13
CVE-2021-23347
4.8 - Medium
- March 03, 2021
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.
XSS
In util/session/sessionmanager.go in Argo CD before 1.8.4
CVE-2021-26921
6.5 - Medium
- February 09, 2021
In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.
Insufficient Session Expiration
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests
CVE-2018-21034
6.5 - Medium
- April 09, 2020
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
Information Disclosure
As of v1.5.0, the Argo web interface authentication system issued immutable tokens
CVE-2020-8826
7.5 - High
- April 08, 2020
As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expirationthere was no refresh or forced re-authentication.
Session Fixation
As of v1.5.0
CVE-2020-8827
7.5 - High
- April 08, 2020
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
authentification
As of v1.5.0, the default admin password is set to the argocd-server pod name
CVE-2020-8828
8.8 - High
- April 08, 2020
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Improper Privilege Management
Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which
CVE-2020-11576
5.3 - Medium
- April 08, 2020
Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.
Side Channel Attack
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Linux Foundation Argo Continuous Delivery or by Linux Foundation? Click the Watch button to subscribe.
