CVE-2022-31054CWE-400

Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events

High · published June 13, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
75.7
In the wild
Unconfirmed
What it is

Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01608 · 75.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-06-13T19:40Z
EPSS history
Timeline
  • 13 JUN 19:40Z
    Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
    cvelistv5