GHSA-PRQF-XR2J-XF65低危已审查

Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`

OSV 1.4.0 · github-reviewed · 修改于 2021-08-24 01:05

发布时间

2021-08-24 03:41

GitHub 审查时间

2021-08-24 01:05

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/08/GHSA-prqf-xr2j-xf65/GHSA-prqf-xr2j-xf65.json

公告说明

Impact

This is pro-active fix. No know exploits exist.

Impacted:

You're running Kubernetes >= v1.19
You're running Argo Server
It is configured to with --auth-mode=client
Is not configured with --auth-mode=server
You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.
You're using client key to authenticate on the server.
The server has more permissions that the connecting client's account.

The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.

Patches

https://github.com/argoproj/argo-workflows/pull/6506

Workarounds

None.

受影响的软件包

github.com/argoproj/argo-workflows/v3

标识信息

别名 / CVE

无

CWE

CWE-285

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-prqf-xr2j-xf65",
  "aliases": [],
  "details": "### Impact\n\nThis is pro-active fix. No know exploits exist. \n\nImpacted:\n\n* You're running Kubernetes >= v1.19\n* You're running Argo Server\n* It is configured to with `--auth-mode=client`\n* Is not configured with `--auth-mode=server`\n* You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.\n* You're using client key to authenticate on the server. \n* The server has more permissions that the connecting client's account.\n\nThe client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.\n\n### Patches\n\nhttps://github.com/argoproj/argo-workflows/pull/6506\n\n### Workarounds\n\nNone.",
  "summary": "Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.9"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/argoproj/argo-workflows/v3",
        "ecosystem": "Go"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.6"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/argoproj/argo-workflows/v3",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2021-08-23T17:05:11Z",
  "severity": [],
  "published": "2021-08-23T19:41:41Z",
  "references": [
    {
      "url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-prqf-xr2j-xf65",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-08-23T17:05:11Z"
  }
}