Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-32476 BIT-argo-cd-2024-32476EUVD-2024-1173GHSA-9m6p-x4h2-6frqGO-2024-2792

Denial of Service via malicious jqPathExpressions in ignoreDifferences

Published Apr 26, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: argoproj Product: Argo CD Package: github.com/argoproj/argo-cd Package: github.com/argoproj/argo-cd/v2 Ecosystem: Go

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.

Affected products

VendorProductAffectedFixed
argoproj argo-cd >= 2.10.0, < 2.10.8, >= 2.9.0, < 2.9.13, < 2.8.17 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/argoproj/argo-cd all versions — GO-2024-2792
Go github.com/argoproj/argo-cd/v2 >= 2.10.0, < 2.10.8 2.10.8 GHSA-9m6p-x4h2-6frq
Go github.com/argoproj/argo-cd/v2 >= 2.9.0, < 2.9.13 2.9.13 GHSA-9m6p-x4h2-6frq
Go github.com/argoproj/argo-cd/v2 < 2.8.17 2.8.17 GHSA-9m6p-x4h2-6frq
Go github.com/argoproj/argo-cd/v2 < 2.8.17 · >= 2.9.0, < 2.9.13 · >= 2.10.0, < 2.10.8 2.8.17, 2.9.13, 2.10.8 GO-2024-2792

References