CVE-2024-47827
Fixed in a distro release EPSS <1%CVSS 5.7
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.
Products: argoproj argo-workflows
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/argoproj/argo-workflows | no fix |
| Go | github.com/argoproj/argo-workflows/v2 | no fix |
| Go | github.com/argoproj/argo-workflows/v3 | 3.6.0-rc2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE Package Hub 12 | govulncheck-vulndb | 0.0.20241104T154416-5.1 |
| openSUSE Leap 15.5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241030T212825-1.1 |