Information Exposure Affecting github.com/argoproj/argo-cd/v2/util/exec Open this link in a new tab package, versions >=1.8.0 <1.8.7 <1.7.14
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDV2UTILEXEC-1296567
-
published
25 May 2021
-
disclosed
21 May 2021
-
credit
Unknown
Introduced: 21 May 2021
CWE-200 Open this link in a new tabHow to fix?
Upgrade github.com/argoproj/argo-cd/v2/util/exec
to version 1.8.7, 1.7.14 or higher.
Overview
github.com/argoproj/argo-cd/v2/util/exec is an Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
Affected versions of this package are vulnerable to Information Exposure. When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged. Anyone with access to the pod logs - either via access with appropriate permissions to the Kubernetes control plane or a third party log management system where the logs from Argo CD were aggregated - could have potentially obtained the credentials to the Helm OCI repository.