Skip to content
OpenAdvisories
Critical RHSA-2024:1752 5 CVEs

Red Hat Security Advisory: GitOps 1.12.1- Argo CD CLI and MicroShift GitOps security update

Published Sep 23, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · Openshift Gitops 1 openshift_gitops:1.12::el8 openshift-gitops-argocd-cli 0:1.12.1-5.el8
Red Hat · Openshift Gitops 1 openshift_gitops:1.12::el8 openshift-gitops-argocd-cli-redistributable 0:1.12.1-5.el8
Red Hat · Openshift Gitops 1 openshift_gitops:1.12::el9 microshift-gitops 0:1.12.1-4.el9
Red Hat · Openshift Gitops 1 openshift_gitops:1.12::el9 microshift-gitops-release-info 0:1.12.1-4.el9
Red Hat · Openshift Gitops 1 openshift_gitops:1.12::el9 openshift-gitops-argocd-cli 0:1.12.1-4.el9
Red Hat · Openshift Gitops 1 openshift_gitops:1.12::el9 openshift-gitops-argocd-cli-redistributable 0:1.12.1-4.el9

Vulnerabilities 5

  • Critical 9.8
    CVE-2024-21652

    Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effecti…

    argoproj Argo CD github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2024-21661

    Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperabl…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2024-21662

    Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. Th…

    argoproj Argo CD
  • Medium 6.5
    CVE-2024-29893

    Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the …

    argoproj Argo CD github.com/argoproj/argo-cd/v2 Go
  • Medium 6.4
    CVE-2023-50726

    Users with `create` but not `override` privileges can perform local sync in argo-cd

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limit…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.openshift.com/gitops/latest/understanding_openshift_gitops/about-redhat-openshift-gitops.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269479
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270170
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270173
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270182
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2272211
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1752.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-50726
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50726
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50726
  • article
    https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac
  • article
    https://github.com/argoproj/argo-cd/commit/3b8f673f06c2d228e01cbc830e5cb57cef008978
  • article
    https://github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm
  • report
    https://access.redhat.com/security/cve/CVE-2024-21652
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-21652
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-21652
  • article
    https://github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv
  • report
    https://access.redhat.com/security/cve/CVE-2024-21661
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-21661
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-21661
  • article
    https://github.com/argoproj/argo-cd/security/advisories/GHSA-6v85-wr92-q4p7
  • report
    https://access.redhat.com/security/cve/CVE-2024-21662
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-21662
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-21662
  • article
    https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d
  • article
    https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b
  • article
    https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456
  • article
    https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454
  • report
    https://access.redhat.com/security/cve/CVE-2024-29893
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-29893
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-29893
  • article
    https://github.com/argoproj/argo-cd/commit/14f681e3ee7c38731943b98f92277e88a3db109d
  • article
    https://github.com/argoproj/argo-cd/commit/36b8a12a38f8d92d55bffc81deed44389bf6eb59
  • article
    https://github.com/argoproj/argo-cd/commit/3e5a878f6e30d935fa149723ea2a2e93748fcddd
  • article
    https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhwx-mhww-rgc3