CVE-2018-21034: Infoleak

Q: What is CVE-2018-21034?

CVE-2018-21034 is a vulnerability in Argo versions prior to v1.5.0-rc1 that allowed authenticated users to retrieve secrets and other manifests stored within git.

Q: How can an authenticated Argo user exploit CVE-2018-21034?

Authenticated Argo users can exploit CVE-2018-21034 by submitting API calls to retrieve secrets and other manifests.

Q: What is the severity of CVE-2018-21034?

CVE-2018-21034 has a severity level of medium, with a CVSS score of 6.5.

Q: Which software versions are affected by CVE-2018-21034?

Argo versions prior to v1.5.0-rc1 and Linuxfoundation Argo Continuous Delivery versions up to and including 1.4.2 are affected by CVE-2018-21034.

Q: Is there a fix available for CVE-2018-21034?

Yes, updating to Argo version 1.5.0-rc1 or higher will fix the vulnerability CVE-2018-21034.

Published Apr 9, 2020

Updated

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.

Affected Software

3 affected componentsFixes available

go/github.com/argoproj/argo-cd<1.5.0-rc1

1.5.0-rc1

linuxfoundation Argo Continuous Delivery Kubernetes<=1.4.2

argoproj Argo CD<=1.4.2

Remediation

Patch Available

https://github.com/argoproj/argo-cd/pull/3088

Event History

Apr 9, 2020

CVE Published

via MITRE·04:18 PM

Data Sourced

via MITRE·04:18 PM

Description

May 24, 2022

Advisory Published

05:13 PM

Frequently Asked Questions

What is CVE-2018-21034?

CVE-2018-21034 is a vulnerability in Argo versions prior to v1.5.0-rc1 that allowed authenticated users to retrieve secrets and other manifests stored within git.

How can an authenticated Argo user exploit CVE-2018-21034?