Fluid Attacks Database

Description

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/argoproj/argo-cd	-	-
go	github.com/argoproj/argo-cd/v2	>=0 <2.1.15 \|\| >=2.2.0 <2.2.9 \|\| >=2.3.0 <2.3.4	2.1.15, 2.2.9, 2.3.4

Aliases

1. CVE-2022-249042. NVD-2022-249043. OSV-GO-2022-04534. OSV-2022-249045. GHSA-6gcg-hp2x-q54h6. GCVE-2022-249047. GHSA-6gcg-hp2x-q54h

References

1. https://github.com/argoproj/argo-cd/commit/5e767a4b9e30983330c0fdec322192281a90eb842. https://github.com/argoproj/argo-cd/commit/7357cfdb58a560de70a0538c6e3bef6fe39505ea3. https://github.com/argoproj/argo-cd/commit/d36d95dc9f71ec61c1a93794f81ece6d61a0d9434. https://github.com/argoproj/argo-cd/releases/tag/v2.1.155. https://github.com/argoproj/argo-cd/releases/tag/v2.2.96. https://github.com/argoproj/argo-cd/releases/tag/v2.3.47. https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.