Buffer overflow in Argo Events Project
CVE-2022-31054
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.016 (74.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Argo Events Project
- Argoproj Argo-Events — versions < 1.7.1
Weakness classification (CWE)
References
- github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57 (Third Party Advisory)
- github.com/argoproj/argo-events/issues/1946 (Third Party Advisory, Issue Tracking)
- github.com/argoproj/argo-events/pull/1966 (Patch, Third Party Advisory)
- github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-31054?
- CVE-2022-31054 is a high-severity vulnerability in Argo Events Project, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2022-06-13.
- How severe is CVE-2022-31054?
- High severity. CVSS v3 base score is 7.5 out of 10.