CVE-2024-40634
22.07.2024, 18:15
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.Enginsight
| Vendor | Product | Version |
|---|---|---|
| argoproj | argo_cd | 1.0.0 ≤ 𝑥 < 2.9.20 |
| argoproj | argo_cd | 2.10.0 ≤ 𝑥 < 2.10.15 |
| argoproj | argo_cd | 2.11.0 ≤ 𝑥 < 2.11.6 |
𝑥
= Vulnerable software versions
References