Lucene search

[email protected]CVE-2022-31016

HistoryJun 25, 2022 - 8:15 a.m.

CVE-2022-31016

2022-06-2508:15:09

CWE-400

CWE-770

[email protected]

web.nvd.nist.gov

argo cd

kubernetes

cve-2022-31016

dos

security vulnerability

nvd

upgrade

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

35.0%

JSON

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.

Affected configurations

Vulners

NVD

Node

argoprojargo_cdRange0.7.0–2.1.16

argoprojargo_cdRange2.0.0–2.2.10

argoprojargo_cdRange2.3.0–2.3.5

CPENameOperatorVersion
linuxfoundation:argo-cdlinuxfoundation argo-cdlt2.1.16
linuxfoundation:argo-cdlinuxfoundation argo-cdlt2.2.10
linuxfoundation:argo-cdlinuxfoundation argo-cdlt2.3.5
linuxfoundation:argo-cdlinuxfoundation argo-cdlt2.4.1

CPE	Name	Operator	Version
linuxfoundation:argo-cd	linuxfoundation argo-cd	lt	2.1.16
linuxfoundation:argo-cd	linuxfoundation argo-cd	lt	2.2.10
linuxfoundation:argo-cd	linuxfoundation argo-cd	lt	2.3.5
linuxfoundation:argo-cd	linuxfoundation argo-cd	lt	2.4.1

CNA Affected

[
  {
    "product": "argo-cd",
    "vendor": "argoproj",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.7.0, < 2.1.16"
      },
      {
        "status": "affected",
        "version": "> 2.0.0, < 2.2.10"
      },
      {
        "status": "affected",
        "version": "> 2.3.0, < 2.3.5"
      }
    ]
  }
]