CVE-2022-31016
published 2022-06-25CVE-2022-31016: Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.83%
52.9th percentile
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | >= 0.7.0 < 2.1.16 | 2.1.16 |
| argoproj | argo_cd | >= 2.2.0 < 2.2.10 | 2.2.10 |
| argoproj | argo_cd | >= 2.3.0 < 2.3.5 | 2.3.5 |
| argoproj | argo_cd | >= 2.4.0 < 2.4.1 | 2.4.1 |
| github.com | argoproj_argo-cd | >= 0.7.0 < 2.1.16 | 2.1.16 |
| github.com | argoproj_argo-cd | >= 0.7.0 | — |
| github.com | argoproj_argo-cd_v2 | >= 0 < 2.1.16 | 2.1.16 |
| github.com | argoproj_argo-cd_v2 | >= 2.2.0 < 2.2.10 | 2.2.10 |
| github.com | argoproj_argo-cd_v2 | >= 2.3.0 < 2.3.5 | 2.3.5 |
| github.com | argoproj_argo-cd_v2 | >= 2.4.0 < 2.4.1 | 2.4.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
osv·2024-08-21
CVE-2022-31016 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
OSV
DoS through large manifest files in Argo CD
osv·2022-06-21
CVE-2022-31016 [MEDIUM] DoS through large manifest files in Argo CD
DoS through large manifest files in Argo CD
### Impact
All versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).
To achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file.
### Patches
A patch for this vulnerability has been released in the following Argo CD versions:
* v2.4.1
* v2.3.5
* v2.2.1
GHSA
DoS through large manifest files in Argo CD
ghsa·2022-06-21
CVE-2022-31016 [MEDIUM] CWE-400 DoS through large manifest files in Argo CD
DoS through large manifest files in Argo CD
### Impact
All versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).
To achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file.
### Patches
A patch for this vulnerability has been released in the following Argo CD versions:
* v2.4.1
* v2.3.5
* v2.2.1
Red Hat
argocd: vulnerable to an uncontrolled memory consumption bug
vendor_redhat·2022-06-15·CVSS 6.5
CVE-2022-31016 [MEDIUM] CWE-400 argocd: vulnerable to an uncontrolled memory consumption bug
argocd: vulnerable to an uncontrolled memory consumption bug
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.
A flaw was found in ArgoCD, which is vulnerable to an uncontrolled memory consumption bug. A crafted manifest file can lead the ArgoCD's repo-server component t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-06-25
Published