CVE-2022-31016CWE-400

Argo CD vulnerable to Uncontrolled Memory Consumption

Medium · published June 25, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00879 · 58.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-06-25T07:40Z
EPSS history
Timeline
  • 25 JUN 07:40Z
    Argo CD vulnerable to Uncontrolled Memory Consumption
    cvelistv5