| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/argoproj/argo-cd | all versions | |
| github.com/argoproj/argo-cd/v2 | ≥ 2.10.0, < 2.10.7≥ 2.4.0, < 2.8.16≥ 2.9.0, < 2.9.12 | 2.10.72.8.162.9.12 |
| argo cd | ≥ 2.10.0, < 2.10.7≥ 2.4.0, < 2.8.16≥ 2.9.0, < 2.9.12 | 2.10.72.8.162.9.12 |
I can convince the UI to let me do things with an invalid Application.
p, michael, applications, *, demo/*, allow, where demo can just deploy to the demo namespacedev which reconciles from ns dev-appsp, michael, applications, sync, dev/*, allow, i.e. no updating via the UI allowed, gitops-onlypwn in dev-apps with project dev and sync the app with sources from gitA patch for this vulnerability has been released in the following Argo CD versions:
v2.10.7 v2.9.12 v2.8.16
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
This vulnerability was found & reported by @crenshaw-dev (Michael Crenshaw)
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free