Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
Résumé
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- patch github.com
- patch github.com
- web pkg.go.dev