ContextQMD
Back to Argo Cd

Snyk test report

docs/snyk/v3.2.7/quay.io_argoproj_argocd_v3.2.7.html

3.4.010.2 KB
Original Source

Untrusted Search Path

high severity

Exploit: Not Defined

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Vulnerable module: go.opentelemetry.io/otel/sdk/resource
  • Introduced through: github.com/argoproj/argo-cd/v3@* and go.opentelemetry.io/otel/sdk/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › go.opentelemetry.io/otel/sdk/[email protected]

Overview

Affected versions of this package are vulnerable to Untrusted Search Path in resource detection code which executes ioreg, when the PATH environment variable is modified to include a malicious executable. An attacker can execute arbitrary code within the context of the application by placing a malicious binary earlier in the search path.

Note: This vulnerability is only exploitable on MacOS/Darwin systems.

Remediation

Upgrade go.opentelemetry.io/otel/sdk/resource to version 1.40.0 or higher.

References

More about this vulnerability

Inefficient Algorithmic Complexity

medium severity

Exploit: Not Defined

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/helm/v3 › /usr/local/bin/helm
  • Package Manager: golang
  • Vulnerable module: golang.org/x/net/html
  • Introduced through: helm.sh/helm/v3@* and golang.org/x/net/[email protected]

Detailed paths

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the html.Parse function due to quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Remediation

Upgrade golang.org/x/net/html to version 0.45.0 or higher.

References

More about this vulnerability

Infinite loop

medium severity

Exploit: Not Defined

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/helm/v3 › /usr/local/bin/helm
  • Package Manager: golang
  • Vulnerable module: golang.org/x/net/html
  • Introduced through: helm.sh/helm/v3@* and golang.org/x/net/[email protected]

Detailed paths

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Infinite loop via the html.Parse function. An attacker can cause resource exhaustion and disrupt service availability by submitting specially crafted HTML input that triggers an infinite parsing loop.

Remediation

Upgrade golang.org/x/net/html to version 0.45.0 or higher.

References

More about this vulnerability

MPL-2.0 license

medium severity

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Module: github.com/r3labs/diff/v3
  • Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/r3labs/diff/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/r3labs/diff/[email protected]

MPL-2.0 license

More about this vulnerability

MPL-2.0 license

medium severity

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Module: github.com/hashicorp/go-version
  • Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/[email protected]

MPL-2.0 license

More about this vulnerability

MPL-2.0 license

medium severity

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Module: github.com/hashicorp/go-retryablehttp
  • Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/[email protected]

MPL-2.0 license

More about this vulnerability

MPL-2.0 license

medium severity

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/helm/v3 › /usr/local/bin/helm
  • Package Manager: golang
  • Module: github.com/hashicorp/go-multierror
  • Introduced through: helm.sh/helm/v3@* and github.com/hashicorp/[email protected]

Detailed paths

MPL-2.0 license

More about this vulnerability

MPL-2.0 license

medium severity

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Module: github.com/hashicorp/go-cleanhttp
  • Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/[email protected]

MPL-2.0 license

More about this vulnerability

MPL-2.0 license

medium severity

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Module: github.com/gosimple/slug
  • Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/gosimple/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/gosimple/[email protected]

MPL-2.0 license

More about this vulnerability

Improper Validation of Integrity Check Value

medium severity

Exploit: Not Defined

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
  • Package Manager: golang
  • Vulnerable module: github.com/go-git/go-git/v5/storage/filesystem
  • Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/storage/[email protected]

Detailed paths

  • Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/storage/[email protected]

Overview

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value for .idx and .pack files. An attacker can cause the application to consume corrupted files, leading to unexpected errors, due to checksums not being checked in the loadIdxFile() function.

Workaround

This vulnerability can be mitigated by running 'git fsck' from the git CLI to check for data corruption on a given repository.

Remediation

Upgrade github.com/go-git/go-git/v5/storage/filesystem to version 5.16.5 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

low severity

Exploit: Not Defined

  • Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argocd › Dockerfile
  • Package Manager: ubuntu:25.04
  • Vulnerable module: glibc/libc-bin
  • Introduced through: docker-image|quay.io/argoproj/[email protected] and glibc/[email protected]

Detailed paths

NVD Description

Note: _Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu._See How to fix? for Ubuntu:25.04 relevant fixed versions and status.

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Remediation

There is no fixed version for Ubuntu:25.04 glibc.

References

More about this vulnerability