CVE-2023-40584
published 2023-09-07CVE-2023-40584: Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.18%
63.7th percentile
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | >= 2.4.0 < 2.6.15 | 2.6.15 |
| argoproj | argo_cd | >= 2.7.0 < 2.7.14 | 2.7.14 |
| argoproj | argo_cd | >= 2.8.0 < 2.8.3 | 2.8.3 |
| github.com | argoproj_argo-cd_v2 | >= 2.4.0 < 2.6.15 | 2.6.15 |
| github.com | argoproj_argo-cd_v2 | >= 2.7.0 < 2.7.14 | 2.7.14 |
| github.com | argoproj_argo-cd_v2 | >= 2.8.0 < 2.8.3 | 2.8.3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd
osv·2024-08-21
CVE-2023-40584 Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd
Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd
Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd
GHSA
Argo CD repo-server Denial of Service vulnerability
ghsa·2023-09-11
CVE-2023-40584 [MEDIUM] CWE-400 Argo CD repo-server Denial of Service vulnerability
Argo CD repo-server Denial of Service vulnerability
### Impact
All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its
OSV
Argo CD repo-server Denial of Service vulnerability
osv·2023-09-11
CVE-2023-40584 [MEDIUM] Argo CD repo-server Denial of Service vulnerability
Argo CD repo-server Denial of Service vulnerability
### Impact
All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its
Red Hat
ArgoCD: Denial of Service to Argo CD repo-server
vendor_redhat·2023-09-05·CVSS 6.5
CVE-2023-40584 [MEDIUM] CWE-400 ArgoCD: Denial of Service to Argo CD repo-server
ArgoCD: Denial of Service to Argo CD repo-server
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674https://github.com/argoproj/argo-cd/security/advisories/GHSA-g687-f2gx-6wm8https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674https://github.com/argoproj/argo-cd/security/advisories/GHSA-g687-f2gx-6wm8
2023-09-07
Published