Fluid Attacks Database

Description

Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/argoproj/argo-cd	>=0.4.0 <2.2.11 \|\| >=2.3.0 <2.3.6 \|\| >=2.4.0 <2.4.5	2.2.11, 2.3.6, 2.4.5
go	github.com/argoproj/argo-cd/v2	>=0 <2.2.11	2.2.11

Aliases

1. CVE-2022-311052. NVD-2022-311053. OSV-2022-311054. OSV-GO-2022-05185. GHSA-7943-82jg-wmw56. GCVE-2022-311057. GHSA-7943-82jg-wmw5

References

1. https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw52. https://github.com/argoproj/argo-cd/releases/tag/v2.3.63. https://github.com/argoproj/argo-cd/releases/tag/v2.4.5