{"id":"CVE-2024-32476","published":"2024-04-26T15:24:13Z","modified":"2024-08-02T02:13:38Z","title":"Denial of Service via malicious jqPathExpressions in ignoreDifferences","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01005,"percentile":0.62947,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac","tags":["x_refsource_MISC"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":12.59},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 2.10.0, < 2.10.8",">= 2.9.0, < 2.9.13","< 2.8.17"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":[">=2.10.0, <2.10.8",">=2.9.0, <2.9.13","<2.8.17"],"patched":["2.10.8","2.9.13","2.8.17"],"from":["GHSA-9m6p-x4h2-6frq","GO-2024-2792"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2792"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1173","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","parents":[{"from":"CVE-2022-24768","to":"CVE-2024-32476","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["controller/appcontroller.go","controller/cache/cache.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657","https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a"],"basis":"rarely changed file"}]},{"from":"CVE-2022-1025","to":"CVE-2024-32476","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["controller/appcontroller.go","controller/cache/cache.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657","https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a"],"basis":"rarely changed file"}]},{"from":"CVE-2022-41354","to":"CVE-2024-32476","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/argocd/commands/app.go"],"commits":["https://github.com/argoproj/argo-cd/commit/3a28c8a18cc2aa84fe81492625545d25c7a90bc3","https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657","https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-21662","published":"2024-03-18","fixed":"2.10.4","kev":false},{"cve":"CVE-2024-29893","published":"2024-03-29","fixed":"2.10.5","kev":false},{"cve":"CVE-2024-31990","published":"2024-04-15","fixed":"2.10.7","kev":false,"link":{"from":"CVE-2024-31990","to":"CVE-2024-32476","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.10.7","toFixed":"2.10.8","daysApart":11}]}},{"cve":"CVE-2024-32476","published":"2024-04-26","fixed":"2.10.8","kev":false},{"cve":"CVE-2024-31989","published":"2024-05-21","fixed":"2.11.1","kev":false,"link":{"from":"CVE-2024-32476","to":"CVE-2024-31989","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.8.17","toFixed":"2.8.19","daysApart":25}]}},{"cve":"CVE-2024-36106","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-37152","published":"2024-06-06","fixed":"2.11.3","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}