Vulnerability · Published Jun 13, 2022 · Assigned by GitHub_M

CVE-2022-31054Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events

High 7.5

In plain English

A high-severity uncontrolled resource consumption in argo-events from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.6%top 23.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/argoproj/argo-events	1.7.1	GHSA-5q86-62xr-3r57
Go	github.com/argoproj/argo-events	1.7.1	GO-2022-0490

Affected products (as reported)

Vendor	Product	Versions
argoproj	argo-events	< 1.7.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57 x_refsource_CONFIRM
https://github.com/argoproj/argo-events/issues/1946 x_refsource_MISC
https://github.com/argoproj/argo-events/pull/1966 x_refsource_MISC
https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35 x_refsource_MISC