Log in Start free

Vulnerability · Published Mar 29, 2024 · Assigned by GitHub_M

CVE-2024-29893Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in argo-cd from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 37.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/argoproj/argo-cd/v22.8.14GHSA-jhwx-mhww-rgc3
Gogithub.com/argoproj/argo-cd/v22.9.10GHSA-jhwx-mhww-rgc3
Gogithub.com/argoproj/argo-cd/v22.10.5GHSA-jhwx-mhww-rgc3
Gogithub.com/argoproj/argo-cd/v22.10.5, 2.8.14, 2.9.10GO-2024-2667

Affected products (as reported)

VendorProductVersions
argoproj argo-cd >= 2.4.0, < 2.8.14>= 2.9.0, < 2.9.10>= 2.10.0, < 2.10.5

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References