CVE-2024-47827

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47827
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75 Product
https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a Patch
https://github.com/argoproj/argo-workflows/pull/13641 Issue Tracking Patch
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:argo_workflows_project:argo_workflows:3.6.0:rc1:*:*:*:kubernetes:*:*
History

05 Nov 2024, 16:50

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.7 		v2 : unknown
v3 : 4.8
First Time Argo Workflows Project
Argo Workflows Project argo Workflows
References () https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75 - () https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75 - Product
References () https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a - () https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a - Patch
References () https://github.com/argoproj/argo-workflows/pull/13641 - () https://github.com/argoproj/argo-workflows/pull/13641 - Issue Tracking, Patch
References () https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr - () https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr - Vendor Advisory
CPE cpe:2.3:a:argo_workflows_project:argo_workflows:3.6.0:rc1:*:*:*:kubernetes:*:*

29 Oct 2024, 14:34

Type Values Removed Values Added
Summary
  • (es) Argo Workflows es un motor de flujo de trabajo nativo de contenedores de código abierto para orquestar trabajos paralelos en Kubernetes. Debido a una condición de ejecución en una variable global en 3.6.0-rc1, cualquier usuario con acceso para ejecutar un flujo de trabajo puede hacer que el controlador de flujos de trabajo de Argo se bloquee cuando así lo ordene. Esta vulnerabilidad se solucionó en 3.6.0-rc2.

28 Oct 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-28 16:15

Updated : 2024-11-05 16:50

NVD link : CVE-2024-47827

Mitre link : CVE-2024-47827

CVE.ORG link : CVE-2024-47827

JSON object : View

Products Affected

argo_workflows_project

  • argo_workflows
CWE
CWE-1108

Excessive Reliance on Global Variables

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')