CVE-2024-32476

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-32476
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 Patch
https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a Patch
https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac Patch
https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq Vendor Advisory
https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 Patch
https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a Patch
https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac Patch
https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
History

09 Jan 2025, 16:59

Type Values Removed Values Added
References () https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 - () https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 - Patch
References () https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a - () https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a - Patch
References () https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac - () https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac - Patch
References () https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq - () https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq - Vendor Advisory
CPE cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Argoproj
Argoproj argo Cd

21 Nov 2024, 09:14

Type Values Removed Values Added
Summary
  • (es) Argo CD es una herramienta declarativa de entrega continua de GitOps para Kubernetes. Existe una vulnerabilidad de denegación de servicio (DoS) a través de OOM usando jq en ignoreDifferences. Esta vulnerabilidad ha sido parcheada en las versiones 2.10.7, 2.9.12 y 2.8.16.
References () https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 - () https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 -
References () https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a - () https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a -
References () https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac - () https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac -
References () https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq - () https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq -

14 May 2024, 15:36

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 15:36

Updated : 2025-01-09 16:59

NVD link : CVE-2024-32476

Mitre link : CVE-2024-32476

CVE.ORG link : CVE-2024-32476

JSON object : View

Products Affected

argoproj

  • argo_cd
CWE
CWE-400

Uncontrolled Resource Consumption

NVD-CWE-noinfo