CVE-2024-31990

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-31990

Severity

4.8

Medium

CVSS V3

Eliminate CVEs with Chainguard hardened images

Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.

Start for free

Summary

Argo CD' API server does not enforce project sourceNamespaces

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-31990
https://github.com/advisories/GHSA-2gvw-w6fj-7m3c
https://pkg.go.dev/vuln/GO-2024-2728
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31990.json
https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c
https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5
https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2024-31990

Severity

Summary

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company