Request for Fixing Identified Vulnerabilities in ArgoCD 2.11.8
- Dominant language
- Go
- Stars
- 24.2k
- Forks
- 7.8k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 234
Description
### Summary
Multiple vulnerabilities have been identified in the ArgoCD image (quay.io/argoproj/argocd:v2.11.8), including one HIGH severity issue and five MEDIUM severity issues. These vulnerabilities span various libraries and could potentially lead to elevation of privilege, denial of service, and information disclosure.
### Details
The following vulnerabilities were detected:
HIGH severity:
Library: github.com/cloudflare/circl (v1.3.3)
Vulnerability: GHSA-9763-4f94-gfch (Timing side-channel in CIRCL's Kyber implementation)
Fixed in version: 1.3.7
MEDIUM severity (selected):
Library: github.com/Azure/azure-sdk-for-go/sdk/azidentity (v1.1.0)
Vulnerability: CVE-2024-35255 (Elevation of Privilege)
Fixed in version: 1.6.0
Library: github.com/hashicorp/go-retryablehttp (v0.7.4)
Vulnerability: CVE-2024-6104 (Potential sensitive information leak to log files)
Fixed in version: 0.7.7
Library: k8s.io/kubernetes (v1.26.11)
Vulnerability: CVE-2024-5321 (Incorrect permissions on Windows containers logs)
Fixed in versions: 1.27.16, 1.28.12, 1.29.7, 1.30.3
### PoC
To reproduce and verify these vulnerabilities:
Pull the ArgoCD image: docker pull quay.io/argoproj/argocd:v2.11.8
Run a vulnerability scanner (e.g., Trivy) against the image
Observe the reported vulnerabilities matching those listed in the Details section
### Impact
Elevation of Privilege: The Azure SDK vulnerability could potentially allow unauthorized access to resources.
Information Disclosure: The go-retryablehttp vulnerability might lead to sensitive information being logged.
Denial of Service: The golang.org/x/net vulnerability could potentially be exploited to cause a DoS condition.
Security Bypass: The Kubernetes vulnerability could allow unauthorized access to container logs on Windows hosts.
These vulnerabilities affect various components of the ArgoCD system and could compromise the security and integrity of deployments managed by ArgoCD. It is recommended to update to a patched version of ArgoCD that includes fixes for these vulnerabilities.
### Screenshot

Contributor guide
Research direction
Start by pulling quay.io/argoproj/argocd:v2.11.8 and running Trivy, as described in the issue. The issue names no repository files or tests; done means updating the affected dependencies or ArgoCD image to versions containing the listed fixes and verifying that the reported vulnerabilities are resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100