CVE-2024-40634

Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

Summary

Original description

The description as published by the source.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami argo-cd

[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.11.6"}]}]

Go github.com/argoproj/argo-cd

[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"last_affected":"1.8.7"}]}]

Go github.com/argoproj/argo-cd/v2

[{"type":"SEMVER","events":[{"introduced":"2.11.0"},{"fixed":"2.11.6"}]}]

References

advisory github.com
advisory nvd.nist.gov
advisory github.com
package github.com
patch github.com
patch github.com
patch github.com
web pkg.go.dev

Metadata

CVE: CVE-2024-40634
GHSA: GHSA-jmvp-698c-4x3w
Published: 2024-07-22
First seen on SecPulse: 2 years ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-400

Detection sources

OSV.dev (Open Source Vulnerabilities) 2 months ago