GO-2024-2654
Denial of service in github.com/argoproj/argo-cd/v2
At a glance
- Published
- Updated
- CVE
- CVE-2024-21661
- Aliases
- BIT-argo-cd-2024-21661, GHSA-6v85-wr92-q4p7
Description
Application may crash due to concurrent writes, leading to a denial of service. An attacker can crash the application continuously, making it impossible for legitimate users to access the service. Authentication is not required in the attack.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/argoproj/argo-cd/v2 | introduced 0, fixed 2.8.13, introduced 2.9.0, fixed 2.9.9, introduced 2.10.0, fixed 2.10.4 |
References
- https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345 FIX
- https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208 FIX
- https://github.com/argoproj/argo-cd/commit/ce04dc5c6f6e92033221ec6d96b74403b065ca8b FIX
- https://github.com/argoproj/argo-cd/blob/54601c8fd30b86a4c4b7eb449956264372c8bde0/util/session/sessionmanager.go#L302-L311 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |