PT-2024-5350 · Argo Cd+1 · Argo Cd+1

Crenshaw-Dev · Published 2024-04-12 · Updated 2025-01-09 · CVE-2024-32476

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 2.10.8 Argo CD versions prior to 2.9.13 Argo CD versions prior to 2.8.17

Description The issue is related to a Denial of Service (DoS) vulnerability via Out of Memory (OOM) using jq in ignoreDifferences. This vulnerability can be exploited by a remote attacker, allowing them to cause a service disruption. The vulnerability is associated with uncontrolled resource consumption when processing the jqPathExpressions parameter.

Recommendations For versions prior to 2.10.8, update to version 2.10.8 or later. For versions prior to 2.9.13, update to version 2.9.13 or later. For versions prior to 2.8.17, update to version 2.8.17 or later. As a temporary workaround, consider restricting the use of the jqPathExpressions parameter in the ignoreDifferences configuration to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-05983

BIT-ARGO-CD-2024-32476

CVE-2024-32476

GHSA-9M6P-X4H2-6FRQ

GO-2024-2792

Affected Products

Argo Cd

Jq

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32476.json · Exploit
• https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657 · Patch
• https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac · Patch
• https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a · Patch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05983 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32476 · Security Note
• https://osv.dev/vulnerability/GO-2024-2792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32476 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m6p-x4h2-6frq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2024-32476 · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://vuldb.com/ru/?id.262172 · Note
• https://twitter.com/CVEnew/status/1783883463084462124 · Twitter Post