SB2022062228 - Multiple vulnerabilities in Argo CD

Description

This security bulletin contains information about 2 vulnerabilities.

1) Insufficient Entropy (CVE-ID: CVE-2022-31034)

CWE-ID: CWE-331 - Insufficient Entropy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. A remote attacker can gain admin access to Argo CD.

2) Out-of-bounds write (CVE-ID: CVE-2022-31036)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a symlink following bug. An adjacent user with repository write access can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v
• https://access.redhat.com/errata/RHSA-2022:5152
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm
• https://bugzilla.redhat.com/show_bug.cgi?id=2096291