~ / search / GHSA-9m6p-x4h2-6frq

GHSA-9m6p-x4h2-6frq

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-32476

Packages

EcosystemPackageAffectedFixed in
Go github.com/argoproj/argo-cd/v2 >= 2.10.0, < 2.10.8 2.10.8
Go github.com/argoproj/argo-cd/v2 >= 2.9.0, < 2.9.13 2.9.13
Go github.com/argoproj/argo-cd/v2 < 2.8.17 2.8.17

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact DoS vuln via OOM using jq in ignoreDifferences. ``` ignoreDifferences: - group: apps kind: Deployment jqPathExpressions: - 'until(true == false; [.] + [1])' ``` ### Patches A patch for this vulnerability has been released in the following Argo CD versions: v2.10.8 v2.9.13 v2.8.17 ### For more information If you have any questions or comments about this advisory: Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions) Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd Credits This vulnerability was found & reported by @crenshaw-dev (Michael Crenshaw) The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue

References

External links from the advisory. They lead to third-party sites.