Vulnerability · Published Oct 28, 2024 · Assigned by GitHub_M

CVE-2024-47827Argo Workflows Controller: Denial of Service via malicious daemon Workflows

Medium 5.7

In plain English

A medium-severity race condition in argo-workflows from argoproj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.4%top 70.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/argoproj/argo-workflows	no fix listed	GO-2024-3226
Go	github.com/argoproj/argo-workflows/v2	no fix listed	GO-2024-3226
Go	github.com/argoproj/argo-workflows/v3	3.6.0-rc2	GHSA-ghjw-32xw-ffwr
Go	github.com/argoproj/argo-workflows/v3	3.6.0-rc2	GO-2024-3226

Affected products (as reported)

Vendor	Product	Versions
argoproj	argo-workflows	>= 3.6.0-rc1, < 3.6.0-rc2

Weakness: CWE-362, CWE-1108 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr x_refsource_CONFIRM
https://github.com/argoproj/argo-workflows/pull/13641 x_refsource_MISC
https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a x_refsource_MISC
https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75 x_refsource_MISC