CVE-2022-31105

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls.

CVSS v3 9.6 CRITICAL
CVSS v2.0 5.1 MEDIUM

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/argoproj/argo-cd/releases/tag/v2.3.6	Release Notes Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.4.5	Release Notes Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:argoproj:argo_cd::::::::
	cpe:2.3:a:argoproj:argo_cd::::::::
	cpe:2.3:a:linuxfoundation:argo-cd::::::::

History

07 Aug 2024, 15:43

Type	Values Removed	Values Added
First Time		Argoproj Argoproj argo Cd
CPE		cpe:2.3:a:argoproj:argo_cd::::::::

Information

Published : 2022-07-12 22:15

Updated : 2024-08-07 15:43

NVD link : CVE-2022-31105

Mitre link : CVE-2022-31105

CVE.ORG link : CVE-2022-31105

JSON object : View

Products Affected

argoproj

argo_cd

linuxfoundation

argo-cd

CWE

CWE-295

Improper Certificate Validation

CWE-599

Missing Validation of OpenSSL Certificate

{"id": "CVE-2022-31105", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "published": "2022-07-12T22:15:08.167", "references": [{"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.3.6", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.4.5", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-599"}]}], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls."}, {"lang": "es", "value": "Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Argo CD a partir de la versi\u00f3n 0.4.0 y anteriores a 2.2.11, 2.3.6 y 2.4.5 es vulnerable a un error de comprobaci\u00f3n de certificados inapropiado que podr\u00eda causar que Argo CD conf\u00ede en un proveedor de OpenID Connect (OIDC) malicioso (o que no sea confiable). Ha sido publicado un parche para esta vulnerabilidad en versiones 2.4.5, 2.3.6 y 2.2.11 de Argo CD. No se presentan mitigaciones completas, pero se presenta una mitigaci\u00f3n parcial. Aquellos que usan un proveedor OIDC externo (no la instancia Dex incluida), pueden mitigar el problema al establecer el campo \"oidc.config.rootCA\" en \"argocd-cm\" ConfigMap. Esta mitigaci\u00f3n s\u00f3lo fuerza la comprobaci\u00f3n del certificado cuando el servidor de la API maneja los flujos de inicio de sesi\u00f3n. No fuerza la verificaci\u00f3n del certificado cuando son verificados los tokens en las llamadas a la API"}], "lastModified": "2024-08-07T15:43:51.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E469B45-C7B5-41BD-9E49-16E5C1A6ECF6", "versionEndExcluding": "2.3.6", "versionStartIncluding": "2.3.0"}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28565EC9-3AFA-48A2-B7BC-8B73A946C967", "versionEndExcluding": "2.4.5", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13AFB715-2612-443D-99B6-FD099C3A1B5C", "versionEndExcluding": "2.2.11", "versionStartIncluding": "0.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}