CVE-2024-32476
Fixed in a distro release EPSS 1%CVSS 6.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.
Products: argoproj argo-cd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/argoproj/argo-cd | no fix |
| Go | github.com/argoproj/argo-cd/v2 | 2.10.8 |
| Go | github.com/argoproj/argo-cd/v2 | 2.9.13 |
| Go | github.com/argoproj/argo-cd/v2 | 2.8.17 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-2.10 | 2.10.8-r0 |
| Chainguard | argo-cd-2.10-compat | 2.10.8-r0 |
| Chainguard | argo-cd-2.10-repo-server | 2.10.8-r0 |
| Chainguard | argo-cd-fips-2.8 | 2.8.17-r0 |
| Chainguard | argo-cd-fips-2.8-compat | 2.8.17-r0 |
| Chainguard | argo-cd-fips-2.8-repo-server | 2.8.17-r0 |
| Chainguard | argo-cd-fips-2.9 | 2.9.13-r0 |
| Chainguard | argo-cd-fips-2.9-compat | 2.9.13-r0 |
| Chainguard | argo-cd-fips-2.9-repo-server | 2.9.13-r0 |
| Wolfi | argo-cd-2.10 | 2.10.8-r0 |
| Wolfi | argo-cd-2.10-compat | 2.10.8-r0 |
| Wolfi | argo-cd-2.10-repo-server | 2.10.8-r0 |