CVE-2022-31054
As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.57% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-787
- Affected
- argo events project/argo events
- Source
- security-advisories@github.com
References
- https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35Patch, Third Party Advisory
- https://github.com/argoproj/argo-events/issues/1946Issue Tracking, Third Party Advisory
- https://github.com/argoproj/argo-events/pull/1966Patch, Third Party Advisory
- https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57Third Party Advisory
- https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35Patch, Third Party Advisory
- https://github.com/argoproj/argo-events/issues/1946Issue Tracking, Third Party Advisory
- https://github.com/argoproj/argo-events/pull/1966Patch, Third Party Advisory
- https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.