fix(deps): update module github.com/argoproj/argo-cd/v2 to v2.11.7 [security] #198
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.11.2
->v2.11.7
GitHub Vulnerability Alerts
CVE-2024-40634
Summary
This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.
Details
The webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case "X-GitHub-Event: push") that will make ArgoCD start allocating memory to parse the incoming request. Since the request can be constructed client-side without allocating large amounts of memory, it can be arbitrarily large. Eventually, the argocd-server component will get OOMKilled as it consumes all its available memory.
The fix would be to enforce a limit on the size of the request being parsed.
PoC
Port-forward to the argocd-server service, like so:
kubectl port-forward svc/argocd-server -n argocd 8080:443
Run the below code:
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.6
v2.10.15
v2.9.20
For more information
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd
Credits
This vulnerability was found & reported by Jakub Ciolek
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
CVE-2024-41666
Argo CD v2.11.3 and before, discovering that even if the user's
p, role:myrole, exec, create, */*, allow
permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access.Description
Argo CD has a Web-based terminal that allows you to get a shell inside a running pod, just like you would with kubectl exec. However, when the administrator enables this function and grants permission to the user
p, role:myrole, exec, create, */*, allow
, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. CVE-2023-40025 Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only userp, role:myrole, exec, create, */*, allow
permissions, which may still lead to the leakage of sensitive information.Patches
A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.7
v2.10.16
v2.9.21
For more information
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd
Credits
This vulnerability was found & reported by
Shengjie Li, Huazhong University of Science and Technology
Zhi Li, Huazhong University of Science and Technology
Weijie Liu, Nankai University
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
Release Notes
argoproj/argo-cd (github.com/argoproj/argo-cd/v2)
v2.11.7
Compare Source
Quick Start
Non-HA:
HA:
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Other work
05edb2a
: feat: verify rbac on each message and not just during handshake (@pasha-codefresh)Full Changelog: argoproj/argo-cd@v2.11.6...v2.11.7
v2.11.6
Compare Source
Quick Start
Non-HA:
HA:
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
b980386
: fix: cherry-pick #18761 (v2.11) (#19108) (@blakepettersson)Other work
540e3a5
: Merge commit from fork (@pasha-codefresh)Full Changelog: argoproj/argo-cd@v2.11.5...v2.11.6
v2.11.5
Compare Source
Quick Start
Non-HA:
HA:
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
c0f780c
: fix(cli): Get Redis password from secret inloadClusters()
(#18951) (#18956) (@gcp-cherry-pick-bot[bot])Other work
d1c052d
: chore: update gitops-engine (2.11) (#19036) (@agaudreault)Full Changelog: argoproj/argo-cd@v2.11.4...v2.11.5
v2.11.4
Compare Source
Quick Start
Non-HA:
HA:
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
d75b23b
: Revert "feat(server): log app Spec along with event (#16416)" (#18458) (#18639) (@gcp-cherry-pick-bot[bot])Bug fixes
24b198b
: fix(appset): revert "keep reconciling even when params error occurred" (#17062) (#18781) (@crenshaw-dev)bfbceff
: fix(controller): bad server-side diffs (#18213) (2.11) (#18868) (@crenshaw-dev)07880f3
: fix(webhook): bitbucket and azure not triggering refresh (#18289) (#18765) (#18819) (@gcp-cherry-pick-bot[bot])b5c13b6
: fix: Update braces package to 3.0.3 (#18459) (#18663) (@gcp-cherry-pick-bot[bot])5fd645f
: fix: docs site version selector broken (#18378) (#18724) (@gcp-cherry-pick-bot[bot])0d1709f
: fix: update static schemas (#18889) (@crenshaw-dev)Documentation
0e71f09
: docs: Fix .path to .path.segments go template (#18872) (#18874) (@gcp-cherry-pick-bot[bot])Dependency updates
c2bd38a
: chore(deps): upgrade redis to 7.2.15-alpine (cherry-pick release-2.11) (#18640) (@34fathombelow)Other work
13844b9
: chore: bump go version to 1.21.10 (#18540) (@34fathombelow)e1284e1
: remove unwanted updating of source-position in app set command (#18887) (#18896) (@gcp-cherry-pick-bot[bot])Full Changelog: argoproj/argo-cd@v2.11.3...v2.11.4
v2.11.3
Compare Source
Quick Start
Non-HA:
HA:
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
46342a9
: fix: app names with non-alphanumeric characters in position 63 break syncs (issue #18237) (#18256) (#18439) (@gcp-cherry-pick-bot[bot])Other work
e01bb53
: Merge pull request from GHSA-3cqf-953p-h5cp (@pasha-codefresh)320abb8
: Merge pull request from GHSA-87p9-x75h-p4j2 (@blakepettersson)cf17283
: fix source ordering issue in manifest generation for multi-source app while using manifests and diff commands (#18395) (#18408) (@gcp-cherry-pick-bot[bot])Full Changelog: argoproj/argo-cd@v2.11.2...v2.11.3
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.