Red Hat Security Advisory

RHSA-2023:0804

Red Hat OpenShift GitOps security update

Released 2023-02-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift GitOps 1.5 openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8 +2

TI-2021-03097 CVE-2021-4238 · GHSA-xg2h-wx96-xgxr

MEDIUM 50

Randomly-generated alphanumeric strings contain significantly less entropy than expected.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01408 Published 2022-12-27 Partial fix · 1.1.1 CWE-331

TI-2023-09744 CVE-2023-23947 · GHSA-3jfq-742w-xg8j

MEDIUM 42

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00671 Published 2023-02-16 Fixed in 2.3.17, 2.4.23 +2 CWE-863

TI-2022-02826 CVE-2022-3064 · GHSA-6q6q-88xp-6f2r

LOW 37

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01871 Published 2022-12-27 Partial fix · 2.2.4 CWE-400