Improper Certificate Validation Affecting github.com/argoproj/argo-cd/v2/util/settings package, versions >=0.4.0 <2.2.11 >=2.3.0 <2.3.6 >=2.4.0 <2.4.5
Threat Intelligence
EPSS
0.18% (57th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDV2UTILSETTINGS-2949178
- published 13 Jul 2022
- disclosed 12 Jul 2022
- credit Michael Crenshaw, jannfis, Adam Korczynski, David Korczynski
Introduced: 12 Jul 2022
CVE-2022-31105 Open this link in a new tabHow to fix?
Upgrade github.com/argoproj/argo-cd/v2/util/settings to version 2.2.11, 2.3.6, 2.4.5 or higher.
Overview
github.com/argoproj/argo-cd/v2/util/settings is a Declarative continuous deployment for Kubernetes.
Affected versions of this package are vulnerable to Improper Certificate Validation. Exploiting this vulnerability could cause Argo CD to trust a malicious (or otherwise untrustworthy) OIDC provider.
Note: In order for this vulnerability to be exploitable, the following conditions must be met:
- The Argo CD instance has SSO enabled.
- insecure mode is not enabled on the API server.
References
CVSS Scores
version 3.1