argoproj / argoproj/argo-cd

Request for Fixing Identified Vulnerabilities in ArgoCD 2.11.8

Open
#20,008 1 comment 1 reaction 0 assignees View on GitHub
bug type:security version:2.11
Dominant language
Go
Stars
24.2k
Forks
7.8k
Avg merge
1d 12h
Merged PRs (30d)
234

Description

### Summary
Multiple vulnerabilities have been identified in the ArgoCD image (quay.io/argoproj/argocd:v2.11.8), including one HIGH severity issue and five MEDIUM severity issues. These vulnerabilities span various libraries and could potentially lead to elevation of privilege, denial of service, and information disclosure.
### Details
The following vulnerabilities were detected:

HIGH severity:

Library: github.com/cloudflare/circl (v1.3.3)
Vulnerability: GHSA-9763-4f94-gfch (Timing side-channel in CIRCL's Kyber implementation)
Fixed in version: 1.3.7

MEDIUM severity (selected):

Library: github.com/Azure/azure-sdk-for-go/sdk/azidentity (v1.1.0)
Vulnerability: CVE-2024-35255 (Elevation of Privilege)
Fixed in version: 1.6.0
Library: github.com/hashicorp/go-retryablehttp (v0.7.4)
Vulnerability: CVE-2024-6104 (Potential sensitive information leak to log files)
Fixed in version: 0.7.7
Library: k8s.io/kubernetes (v1.26.11)
Vulnerability: CVE-2024-5321 (Incorrect permissions on Windows containers logs)
Fixed in versions: 1.27.16, 1.28.12, 1.29.7, 1.30.3

### PoC
To reproduce and verify these vulnerabilities:

Pull the ArgoCD image: docker pull quay.io/argoproj/argocd:v2.11.8
Run a vulnerability scanner (e.g., Trivy) against the image
Observe the reported vulnerabilities matching those listed in the Details section

### Impact

Elevation of Privilege: The Azure SDK vulnerability could potentially allow unauthorized access to resources.
Information Disclosure: The go-retryablehttp vulnerability might lead to sensitive information being logged.
Denial of Service: The golang.org/x/net vulnerability could potentially be exploited to cause a DoS condition.
Security Bypass: The Kubernetes vulnerability could allow unauthorized access to container logs on Windows hosts.

These vulnerabilities affect various components of the ArgoCD system and could compromise the security and integrity of deployments managed by ArgoCD. It is recommended to update to a patched version of ArgoCD that includes fixes for these vulnerabilities.

### Screenshot
![image](https://github.com/user-attachments/assets/4fd5188e-8955-4749-9e92-3460e75d9d2f)

Contributor guide

Open the contributing guide

Research direction

Start by pulling quay.io/argoproj/argocd:v2.11.8 and running Trivy, as described in the issue. The issue names no repository files or tests; done means updating the affected dependencies or ArgoCD image to versions containing the listed fixes and verifying that the reported vulnerabilities are resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go, kubernetes
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.