Red Hat Security Advisory

RHSA-2022:1039

Red Hat OpenShift GitOps security update

Released 2022-03-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift GitOps 1.2 openshift-gitops-1/argocd-rhel8

Fixes 3 records

TI-2022-00922 CVE-2022-1025 · GHSA-96jv-vj39-x4j6

Improper access control in ArgoCD

MEDIUM 41

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01345 Published 2022-07-12 Fixed in 2.1.14, 2.2.8 +1 CWE-284

TI-2022-08544 CVE-2022-24730 · GHSA-r9cr-hvjj-496v

Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

LOW 35

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00895 Published 2022-03-23 Fixed in 2.1.11, 2.2.6 +1 CWE-22

TI-2022-08545 CVE-2022-24731 · GHSA-h6h5-6fmq-rh28

Path traversal allows leaking out-of-bound files from Argo CD repo-server

LOW 32

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.0096 Published 2022-03-23 Fixed in 2.1.11, 2.2.6 +1 CWE-22