Brute Force Affecting github.com/argoproj/argo-cd/v2/util/session package, versions <2.8.13 >=2.9.0-rc1 <2.9.9 >=2.10.0-rc1 <2.10.4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDV2UTILSESSION-6457469
- published 19 Mar 2024
- disclosed 19 Mar 2024
- credit Nadav Aharon-Nov
Introduced: 19 Mar 2024
CVE-2024-21662 Open this link in a new tabHow to fix?
Upgrade github.com/argoproj/argo-cd/v2/util/session to version 2.8.13, 2.9.9, 2.10.4 or higher.
Overview
github.com/argoproj/argo-cd/v2/util/session is a declarative, GitOps continuous delivery tool for Kubernetes.
Affected versions of this package are vulnerable to Brute Force by overflowing the login cache mechanism. An attacker can reset the defaultMaxCacheSize (including for the default admin account) by making many login attempts for different users, thus removing entries for previous failed attempts for the target account.
This is a bypass for the previously reported CVE-2020-8827.