PT-2024-2499 · Argo Cd · Argo Cd

Jakub Ciolek · Published 2024-03-29 · Updated 2025-01-09 · CVE-2024-29893

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Argo CD versions 2.4 through 2.10.2 Argo CD versions 2.4 through 2.9.7 Argo CD versions 2.4 through 2.8.11

Description The issue is related to the loadRepoIndex() function in Argo CD's helm package, which does not limit the size or time while fetching data from a Helm registry. This can lead to a Denial-of-Service attack vector, where the repo server component can be crashed through an out of memory error by pointing it to a malicious Helm registry. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it.

Recommendations For versions 2.4 through 2.10.2, update to version 2.10.3 or later. For versions 2.4 through 2.9.7, update to version 2.9.8 or later. For versions 2.4 through 2.8.11, update to version 2.8.12 or later. As a temporary workaround, consider restricting access to the vulnerable loadRepoIndex() function in the Argo CD's helm package until a patch is available.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-02480

BIT-ARGO-CD-2024-29893

CVE-2024-29893

GHSA-JHWX-MHWW-RGC3

GO-2024-2667

RHSA-2024:1752

Affected Products

Argo Cd

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29893.json · Exploit
• https://github.com/argoproj/argo-cd/commit/14f681e3ee7c38731943b98f92277e88a3db109d · Patch
• https://github.com/argoproj/argo-cd/commit/36b8a12a38f8d92d55bffc81deed44389bf6eb59 · Patch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhwx-mhww-rgc3 · Vendor Advisory
• https://github.com/argoproj/argo-cd/commit/3e5a878f6e30d935fa149723ea2a2e93748fcddd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29893 · Security Note
• https://osv.dev/vulnerability/GO-2024-2667 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jhwx-mhww-rgc3 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2024-29893 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29893 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02480 · Security Note
• https://github.com/argoproj/argo-cd · Note
• https://vuldb.com/?id.258690 · Note
• https://twitter.com/CVEnew/status/1773730743333658753 · Twitter Post
• https://t.me/cvenotify/106924 · Telegram Post