Resource exhaustion in Argoproj Argo-Cd
CVE-2024-29893
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.010 (58.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Argoproj Argo-cd — versions >= 2.4.0, < 2.8.14, >= 2.9.0, < 2.9.10, >= 2.10.0, < 2.10.5
- Argoproj Argo_cd
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-29893?
- CVE-2024-29893 is a medium-severity vulnerability in Argoproj Argo-Cd, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2024-03-29.
- How severe is CVE-2024-29893?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-29893 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.