GHSA-prqf-xr2j-xf65 – github.com/argoproj/argo-workflows/v3

Package

Manager: go
Name: github.com/argoproj/argo-workflows/v3
Vulnerable Version: >=3.0.0 <3.0.9 || >=3.1.0 <3.1.6

Severity

Level: Low

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: N/A pctlN/A

Details

Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` ### Impact This is pro-active fix. No know exploits exist. Impacted: * You're running Kubernetes >= v1.19 * You're running Argo Server * It is configured to with `--auth-mode=client` * Is not configured with `--auth-mode=server` * You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM. * You're using client key to authenticate on the server. * The server has more permissions that the connecting client's account. The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account. ### Patches https://github.com/argoproj/argo-workflows/pull/6506 ### Workarounds None.

Metadata

Created: 2021-08-23T19:41:41Z
Modified: 2021-08-23T17:05:11Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-prqf-xr2j-xf65/GHSA-prqf-xr2j-xf65.json
CWE IDs: ["CWE-285"]
Alternative ID: N/A
Finding: F039
Auto approve: 1