Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00416.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
argoproj argo-cd affected
Version Status Constraints
>= 2.10.0, < 2.10.8 affected —
>= 2.9.0, < 2.9.13 affected —
< 2.8.17 affected —

Configuration 1 [-]

OR cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Argoproj Subscribe
Argo Cd Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2024-1173 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.
Github GHSA Github GHSA GHSA-9m6p-x4h2-6frq Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 cve-icon cve-icon cve-icon
https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a cve-icon cve-icon cve-icon
https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac cve-icon cve-icon cve-icon
https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq cve-icon cve-icon cve-icon
History

Thu, 09 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Argoproj
Argoproj argo Cd
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
Vendors & Products Argoproj
Argoproj argo Cd

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-08-02T02:13:38.994Z

Reserved: 2024-04-12T19:41:51.167Z

Link: CVE-2024-32476

cve-icon Vulnrichment

Updated: 2024-08-02T02:13:38.994Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-14T15:36:25.953

Modified: 2025-01-09T16:59:02.680

Link: CVE-2024-32476

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses