RHSA-2024:2817: Important: Errata Advisory for Red Hat OpenShift GitOps v1.10.5 security update
Errata Advisory for Red Hat OpenShift GitOps v1.10.5.<br>Security Fix(es):<br><li> argo-cd: webpack-dev-middleware: lack of URL validation may lead to file leak (CVE-2024-29180).</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br>1. Fix for a critical bug reported by customers where IgnoreDifferences Option<br>in Sync Options was not working for array fields in ArgoCD. This fix will allow the users to ignore specific fields in the array when specified in<br>ignoreDifferences during Sync.<br>2. A fix that enables customer to add clusters hosted on GCP to ArgoCD.<br>3. An important customer fix that ensures that Argo CD correctly reports support for these host key algorithms during the handshake process, allowing the pull from Azure DevOps Repos to succeed.
Other sources
Important: Errata Advisory for Red Hat OpenShift GitOps v1.10.5 security update
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:2817?
The severity of RHSA-2024:2817 is determined by the CVSS score assigned to CVE-2024-29180.
How does CVE-2024-29180 affect Red Hat OpenShift GitOps?
CVE-2024-29180 affects Red Hat OpenShift GitOps due to a lack of URL validation that may lead to file leakage.
What versions of Red Hat OpenShift GitOps are affected by RHSA-2024:2817?
RHSA-2024:2817 affects multiple versions of Red Hat OpenShift GitOps, including v1.10.5.
How do I fix the vulnerability described in RHSA-2024:2817?
To fix the vulnerability described in RHSA-2024:2817, update Red Hat OpenShift GitOps to the latest patched version.
Is there a known exploit for CVE-2024-29180?
As of now, there are no known active exploits for CVE-2024-29180, but users are advised to apply the update to mitigate risks.