VulnerabilityModified

CVE-2022-31105

Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider.

CRITICAL 9.6EPSS 0.78%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls.

CVSS 3.1: 9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS: 0.78% probability · 54th percentile
CISA KEV: Not listed
Weakness: CWE-295, CWE-599
Affected: argoproj/argo cd · linuxfoundation/argo-cd
Source: security-advisories@github.com

References

https://github.com/argoproj/argo-cd/releases/tag/v2.3.6Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.4.5Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.3.6Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.4.5Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.