REDHAT-BUG-2342987: Medium severity argocd vulnerability
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2342987?
The severity of REDHAT-BUG-2342987 is classified as moderate due to the exposure of sensitive secret values.
How do I fix REDHAT-BUG-2342987?
To fix REDHAT-BUG-2342987, update Argo CD to version 2.13.5 or later.
What versions of Argo CD are affected by REDHAT-BUG-2342987?
Argo CD versions 2.11.13, 2.12.10, and 2.13.4 are affected by REDHAT-BUG-2342987.
What impact does REDHAT-BUG-2342987 have on Argo CD users?
The impact of REDHAT-BUG-2342987 allows unauthorized users to potentially view sensitive secret values through error messages.
Is there a workaround for REDHAT-BUG-2342987?
There is no documented workaround for REDHAT-BUG-2342987; updating to a patched version is recommended.