Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-31034— Insecure entropy in argo-cd

CVSS 8.3 · High EPSS 0.42% · P62
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-31034

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insecure entropy in argo-cd
Source: NVD (National Vulnerability Database)
Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a relatively-predictable (time-based) seed in a non-cryptographically-secure pseudo-random number generator made the parameter less random than required by the relevant spec or by general best practices. In some cases, using too short a value made the entropy even less sufficient. The attacks on login flows which are meant to be mitigated by these parameters are difficult to accomplish but can have a high impact potentially granting an attacker admin access to Argo CD. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用不充分的随机数
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat OpenShift 安全特征问题特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat OpenShift是美国红帽（Red Hat）公司的一款平台即服务（PaaS）云计算平台，它支持构建、测试、部署和运行应用程序。 Red Hat OpenShift GitOps 1.5 存在安全特征问题漏洞，该漏洞源于当从 Argo CD CLI 或 UI 启动 SSO 登录时，容易受到各种攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
argoprojargo-cd >= 0.11.0, < 2.1.16 -

II. Public POCs for CVE-2022-31034

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-31034

请登录查看更多情报信息。

Same Patch Batch · argoproj · 2022-06-27 · 3 CVEs total

CVE-2022-310359.0 CRITICALExternal URLs for Deployments can include javascript in argo-cd
CVE-2022-310364.3 MEDIUMSymlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

IV. Related Vulnerabilities

Same product: argo-cd
Same vendor: argoproj
Same weakness: CWE-330

V. Comments for CVE-2022-31034

No comments yet

Leave a comment