GHSA-6C73-2V8X-QPVM中危已审查

Argo Server TLS requests could be forged by attacker with network access

OSV 1.4.0 · github-reviewed · 修改于 2021-08-24 01:02

发布时间

2021-08-24 03:41

GitHub 审查时间

2021-08-24 01:02

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/08/GHSA-6c73-2v8x-qpvm/GHSA-6c73-2v8x-qpvm.json

公告说明

Impact

We are not aware of any exploits. This is a pro-active fix.

Impacted:

You are running Argo Server < v3.0 with --secure=true or >= v3.0 with --secure unspecified (note - running in secure mode is recommended regardless).
The attacker is within your network. If you expose Argo Server to the Internet then "your network" is "the Internet".

The Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.

Patches

https://github.com/argoproj/argo-workflows/pull/6540

Workarounds

Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.

This was identified by engineers at Jetstack.io

受影响的软件包

github.com/argoproj/argo-workflows/v3

标识信息

别名 / CVE

无

CWE

无

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-6c73-2v8x-qpvm",
  "aliases": [],
  "details": "### Impact\n\nWe are not aware of any exploits. This is a pro-active fix.\n\nImpacted: \n\n* You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless).\n* The attacker is within your network. If you expose Argo Server to the Internet then \"your network\" is \"the Internet\". \n\nThe Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.\n\n### Patches\n\nhttps://github.com/argoproj/argo-workflows/pull/6540\n\n### Workarounds\n\n* Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.\n\nThis was identified by engineers at Jetstack.io",
  "summary": "Argo Server TLS requests could be forged by attacker with network access",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.9"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/argoproj/argo-workflows/v3",
        "ecosystem": "Go"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.6"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/argoproj/argo-workflows/v3",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2021-08-23T17:02:24Z",
  "severity": [],
  "published": "2021-08-23T19:41:30Z",
  "references": [
    {
      "url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-6c73-2v8x-qpvm",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-08-23T17:02:24Z"
  }
}