Improper Verification of Cryptographic Signature Affecting argo-workflows-fips-3.6 package, versions <3.6.11-r1


Severity

Recommended
0.0
low
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.01% (2nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-ARGOWORKFLOWSFIPS36-13277163
  • published4 Oct 2025
  • disclosed6 Aug 2025

Introduced: 6 Aug 2025

CVE-2025-8556  (opens in a new tab)
CWE-347  (opens in a new tab)

How to fix?

Upgrade Chainguard argo-workflows-fips-3.6 to version 3.6.11-r1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream argo-workflows-fips-3.6 package and not the argo-workflows-fips-3.6 package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

CVSS Base Scores

version 3.1