CVE-2024-31989
criticalPriorität · beachten · 47OT-Risiko · hochEPSS 0.015 · 74. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-24
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:68a55e1bd9353f39a908a968308da01bd5d2c748ddd01e48690fd7704e1ad76f_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:90b9703fc05ae0fea66449f84cbed3d65e1265a94b3b9e7b56128655765481a7_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:b10bdc2d2da9da113fbc8db917475fe669f35d3a8024fa2d688720a7111392f2_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:dfc1fa067d02b42535e1a1caa76b4260e35f45420837da60fe7fa139e013192e_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:42633acdcfc013a327bcd30f4fb3eb8f057587caffa52c5849d0a9d1c5e45ce5_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:755ed5fa7ec7fe6ab0eaece585de1467f75aa9a77ab1fe3a10978a856ed34e6d_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:8a97de100b5377ccf3efaafcdc9b4bb6fc31ca44cb8310aab7b13c9392408201_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:eab1fd0bbe9de639d3291202b29211016489dd008b809ea331d85135f52e17bf_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:0938da95911ba88faa3a2d6edaf02d9875f21c633e86c1a6fb261f34cb4c9605_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:1d7a9883dc35ede864197d7170929e7fbd5fed5e331785719328cb3a27ea7770_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:5316dda07e6091408343a6edba9693cef522b279b135fd061d8cb79d78708b54_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:c26c1ffe6fdfc7182ed1f925e552f0e4fc9d6ad4479f1fe2e1acbf0379c6a7fa_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/dex-rhel8@sha256:2d5f73229fa9c96e880f79390360626f8f43999a2264f5cb44873aa6226f8c93_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/dex-rhel8@sha256:71716eaf6e424c2c9ed15360a09a9a9a31d30afb0c3872a1d1d83068e6aaa7b9_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/dex-rhel8@sha256:84f07a0dfc6466e124cfbcddfb40bef5d1c2160ef1368cdd763e263f0dba309b_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/dex-rhel8@sha256:9357c7a93739df97d4e62e1d9e6b9ba9d3b940165f0d579070fca73a3fdb8e83_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-operator-bundle@sha256:3da4a6840665ba50c699bf22a7258ee5f6912c589a3a1b278caa887c877bf9f2_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:56ece8c43387aac7f0abb59dd1ae150522d5bb3bdd7a9053723bdc44d6c30a17_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:736695a8d2d7e22c0a061fcd3c38bf8f4ff9fb7cae6d7ecf0b20cbfd5bccb252_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:8ad3dac8f66626104cfa06fcf913db665528923fe48b26726cfa36a826f4017d_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:e416e186379ff67d7fd8b830de8cf0ba24e004897d1a64659ab011c1b6ac0160_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:05cd8f780df5189690fcf7c70a0d3f2d7472fbaf0b9b95cf9950c65e96d27984_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:22b76c1375dea7b506e354c72363cfa5dc0b7073f67ca7591bae2d0816f7f547_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:3f394bcdfa8421cbf9c3ecfa47065a9c6e3b0d570cb038f5a4e5b3e908711ed6_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:74ecef2e1fd133dbd4db27d25dafc711e0a041cb53f31085a67d8e18db4e0045_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:092e6b9a6b22e3b67e3306beaed42f4ebe671c6d76ef83cb8872d8fce9904298_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:2a71959e7e973f025f0e97988e8ecdcda7bd8e586abe16ec273d43b3b607a69e_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:2c397a92051335f4b81874c7e6c3ae02207caeeabba8268b28a1202a673c5a85_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:647ae1980151675b2db5275f7fbe6df809e18465531e3f917f622e77340bf3f3_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:2f57e391a8a521ca5676fc60c3d09dc9791ab020bcb6ac2af1469b402ed44c13_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:365e0c1afd6f37b97a2d65869301ed8d453af12082e3b9ddc839005542fa5f7e_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:a9078be71cd9e21c0f481d1c3d9a497fdf7e7b92b144294319d7229039122d31_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:c634cc4b744bedd76eb7c170b9e27292f9afad1b193f470acd8b2ee77063bac2_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3368 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:0608ca9bc5c778b10056ce89287ebce6329ef1d15a521aa764c36be2d2c83fd6_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:4dede36872408d83618f264bbea1774f72d57c682bf5d8bbefffc120b045343c_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:64dd56354e5b7d467307beee042b329aea149caea0b03400649dc4e0ec96a024_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:f0037ac4a08f2b1d8be4c32a3f054774f07e71f0a069d3ce623552ed4924b584_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:1ed6d86544f6c3a295cdc17a9268cd91f79f714c6f4ab3cff94c9e66a6fe2aaa_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:5cf362a5c8defc1784a752aef1384f81e8efda6318f5536a64eb90335558508c_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:688eb12e6b880ed645bb588b3adafeb4736b179a1606ddaf58f9c2de022a35f6_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:f782a2d1f8b01be13a11e651540f9791e52246a764f7627cc9fba9f84834be4a_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:1a0a1f97664033388776bb04df16473f9cd5c500bed97165cedff8a7030fd868_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:58a4e77d29c5277559518d042cf84e083be1408eb397c20bcd56c3d8b80c7b1f_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:c79af79d95a745692d814b2dfd01651cc658a0e4f682cfb8e50815b91b453199_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:d59d44911f7f2c702524a93cafeee53475904d124313425e80fc5b5404d7873e_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/dex-rhel8@sha256:3d67cf48a48e80b2a7afcd62279ec9ccfd782ac0a28a8c8fc32d4d674fc930d7_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/dex-rhel8@sha256:655eb264bf4abcfa23dc3c15379400afcef3281514880d5152a09917fe86f322_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/dex-rhel8@sha256:6991b62c782f4ca2d133636d6cf12da3d63a799cb01e857f442800dcafe3677f_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/dex-rhel8@sha256:c3972e66a24fc340f5fb87d5e14afede851dbbac24061c84f94623bc826091d7_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-operator-bundle@sha256:ed530db9b4a29fb591ea208cd0c6b3b83b49537ff5a0a4f501b54ce667f9b303_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:174f1e9de387d98cbbbbe90c5bdbeb3b7858ce6f43701aff7d6d72f3c7b87746_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:6a674317b6ab5a65a4abadecff028dd03ceacd0d819841afb6365d604b08b4fe_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:78bea74dee090be584bd0b9cbe4eee34083deea1a01a3b234002eafdb97cd2da_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:90225f439b88ca9db06965fd22026b053836ed06bf286b7a80c0e33bd389377f_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:15b985be0cbe682fc899666235c9475957ea6fa5512b3b7cd587a3ef5fd8bb93_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:2f773920fe6d238ac0521062bdd4bc55ada31936aec5d7ec28b562e78646a545_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:7e428454aeb35c640bb9ae607f95e523ffbead6788cdea0c8c99bd8ae9a8451a_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:cc7a542c4ee755a60c1cb688a2fac4c6887a7d89b8d9634ed7447a45023c8157_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:5a3d73268b62e644001cd7c3a99f997b83df62ae66d9dbdf336e90fd64e58128_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:9a9b0fcd52a78dec186643343ca513875c9a234555e5c406580b616afc03e404_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:a81faaa39945fe28a767fce051d15b8db761369994ac351b85a08aeaca0bfebd_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:b3497e092e4800eb989397a335516e8773ce74ac122a58402f245e9689379f73_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:2ecd43a2f7fb1a45c7f9bb3d77c7efa98b17317e92f06dd543f7e4b9ffe7b05d_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:2eda7599f9454e50c60949f75447e4599d4f8a7e2a9fd37f32a1a0c4e6078fcb_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:827d9ee1eb2463b489ec68f8994fa07fe2ead0255801311a0b27cc1a38b7f232_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:d7384c2354d5ebfbb25da696b269dfa460137489ea23d58bcf4a5a4c4571caec_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3369 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:06fc8566a1cfbdb2f1ed125bd71014702e19544bb0179e301f50b739f550a4be_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:6e7f12f0675c95873771db64474d94267adc65459551f34f87981e86800dd02e_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:b4b59e8f962ddd3daf5d170726815e5e7179f167223d8b503b690e6c47146bc5_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argo-rollouts-rhel8@sha256:d94a51a1973c588321cba6d6c983f18512eeb4d1435cc2d2d11a0f655c4e6459_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:5740496753c2361e8e92c6ae10fc514f04fd4be2431937441c37d683d59a93d8_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:6120ce466454abbe0af5c595f5d5eaeba7ab8f6574a58a4e48fc75e37fb282f3_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:87533903151ce49782aaaeeffe0fd62be115e597d91ac2040305c1fa5c77c53e_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/argocd-rhel8@sha256:99651d795a65cacffc34179020c152910ab7782b0d6bfadebd0d80971a501ff2_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:00137bee6c32d7846f2ad59f6cb9a83cd6a3fa6c99ea5cb8e7babf43a03d90ee_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:8002f248c7839ad4711786c44633df8c63cd36b17076de350db5762ecaad3d29_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:bbeb98c04cd3ba61eace67c37c4adea853d8fa5f399331ccf819dc0dcc727283_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/console-plugin-rhel8@sha256:c6497194f930aa64f188223f49b34943e0a71dad17e7c9a6f3b46a840af28ef1_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/dex-rhel8@sha256:1c2505f0cdf01630f1601e47916a0bdbd896bcaa794f3d333206cd474edec7d1_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/dex-rhel8@sha256:4f0bd0fefebf3e1031bbe582715fa1ce94bd2ae5049dc5a832f2bea736cdffd4_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/dex-rhel8@sha256:bd06095ff4d751cc803e4e11b58a5dd13f4a4b09ae82a270c52e0aba0c5959b3_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/dex-rhel8@sha256:f8f749f0825ca82d63a7245f67928455083d99bee615182e90ea58c5bf41eff2_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-operator-bundle@sha256:88a72e0653b7393fc6857838932415a53c1e7592203eebb8ebde5a66ea5b8bb8_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:243efd0ad21a3213d82dddd842c2518a8e30368fd8b8ebc255ed8215784961a1_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:477b4677f1f4a87c44d78c0e81ea7e312189921b70597dfed8042f4ee9cf88eb_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:6c453b7135a9a3493e3aa8a95677bce041c93678b5b4c6c884c163396da426f0_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8-operator@sha256:dd4c438f7935f52b8a4eee3ef1616737af58b841d4fee9525875e49dfb19a859_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:67787e52e16eb0a1ff010a33eae05e90e35e6dda205029461b2020d6e7ee8d86_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:df921fbc40d2da42048119d869952a12d1568efc79d6f87b63a4f5616bddb572_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:eb888417cf8c3503bebc1fe2537d1a5a640d80a2a3bc2e88564cdbd46764a7c3_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/gitops-rhel8@sha256:fe41a4edef343e6157551299059aeb843e530388f2964d0c8185262e4e1d7b93_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:0a2d931084570e7e007fb4ab2bce16c2943680366dc236e7d9b747c86904a4e1_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:155c354acb1e8251839fa10700d59c15522efd6b13d1fdeef58bac6b66a249e5_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:73355f71611cadf04b6733c62961805ffd2b59524afc917665f50bf3e3645613_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/kam-delivery-rhel8@sha256:8d3564c0b26d6573ab33ea9a9845394396f6cc8422ab7b1108978c2be2495457_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:1ec5ee1a0051c79bf73fcabda81e3bf6464a888634a2d1d3bd50dee0385f8475_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:270f878d78cfab355b6df30341b7775420110da2ee8e5f8aa2c20b6b75dcf905_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:661885ca6e56357da49f772e5c1c704121fba789519de90ebe08699ce2a1b64c_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475 - Behobenopenshift-gitops-1/must-gather-rhel8@sha256:d9b862b94a9620a43ad17c2dec419dddf98282f7db3ef0b008761238b3e2103d_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:3475
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.5–9.6
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (1)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- vt0x78/CVE-2024-31989Exploit for CVE-2024-31989.PoC · poc_in_github
betroffene Produkte (120)
Betroffene Produkte und Versionsbereiche.
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- RHSA-2024:3368Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.12.3 security update2024-05-28csaf · redhat_csafUS
An update is now available for Red Hat OpenShift GitOps v1.12.3 to address the CVE-2024-31989, Unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2024:3369Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.10.6 security update2024-05-28csaf · redhat_csafUS
An update is now available for Red Hat OpenShift GitOps v1.10.6 to address the CVE-2024-31989, Unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2024:3475Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.11.5 security update2024-05-29csaf · redhat_csafUS
An update is now available for Red Hat OpenShift GitOps v1.11.5 to address the CVE-2024-31989, Unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2024-1239Red Hat OpenShift GitOps: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2024-05-27csaf · cert_bundDE
Ein Angreifer aus einem unprivilegierten Pod auf demselben Cluster kann eine Schwachstelle in Red Hat OpenShift GitOps ausnutzen, um seine Privilegien zu erhöhen.
- GHSA-9766-5277-j5hrArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache2024-05-21ghsa · osvUS
### Summary By default, the Redis database server is not password-protected. Consequently, an attacker with access to the Redis server can gain read/write access to the data in Redis. The attacker can also modify the "mfst" (manifest) key to cause ArgoCD to execute any deployment, potentially leveraging ArgoCD's high privileges to take over the cluster. Updating the "cacheEntryHash" in the manifest JSON is necessary, but since it doesn't use a private key for signing its integrity, a simple script can generate a new FNV64a hash matching the new manifest values. The repo-server, unable to verify if its cache is compromised, will read the altered "mfst" key and initiate an update process for the injected deployment. It's also possible to edit the "app|resources-tree" key, causing the ArgoCD server to load any Kubernetes resource into the live manifest section of the app preview. This could lead to an information leak. The fact that the cache in Redis is neither signed nor validated, combined with Redis's default lack of password protection, presents a significant security concern given ArgoCD's high-level permissions within the cluster. A security update should ensure all Redis database values are signed or encrypted. ### Details We began by deploying ArgoCD on an EKS cluster. Surprisingly, we discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. This was unexpected, as we had observed network policy rules restricting access to the Redis server to only the pods application-controller, repo-server, and argocd-server. We later realized that, despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. We also know your recommendation on this page [Argo CD - Secret Management](https://argo-cd.readthedocs.io/en/stable/operator-manual/secret-management/#mitigating-risks-of-secret-injection-plugins), to enable the network policy plugin. Further investigation revealed that any pod within my cluster could connect to the Redis server by resolving its address using the Kubernetes DNS server. Exploring the contents of the Redis server, we found that we could edit the 'mfst' value of the latest revision. By updating the “cacheEntryHash”, we made the repo-server accept it as a legitimate cache, leading ArgoCD to apply this configuration. These tests were conducted using the default configuration, with regular ArgoCD and ArgoCD via helm deployment. This scenario presents a viable attack path, enabling any pod with access to the cluster to potentially exploit ArgoCD's high permissions and take over the cluster. We believe there is a critical need to enhance the security of the cache and its components. Given that many clients likely use ArgoCD in a plug-and-play manner, they could be exposed to significant risk. I am willing to offer assistance or answer any questions you might have. ### PoC We tested this using the latest version of ArgoCD, configured with default settings. ArgoCD was installed either by applying a YAML file or through Helm. We wrote a few Go programs to decompress the Redis values and regenerate the "cacheEntryHash", but these programs were relatively straightforward. To modify the cluster deployment, you can alter the "mfst" key of the latest revision. For instance, add the following line: ```json {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"labels":{"app.kubernetes.io/instance":"myapp1"},"name":"everything-allowed"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"everything-allowed"}},"template":{"metadata":{"labels":{"app":"everything-allowed"}},"spec":{"containers":[{"args":["while true; do sleep 30; done;"],"command":["/bin/sh","-c","--"],"image":"ubuntu","name":"everything-allowed-pod","securityContext":{"privileged":true},"volumeMounts":[{"mountPath":"/host","name":"noderoot"}]}],"hostIPC":true,"hostNetwork":true,"hostPID":true,"volumes":[{"hostPath":{"path":"/"},"name":"noderoot"}]}}} ``` This addition creates a highly privileged pod. To cause the web page to load a different Kubernetes resource in the "Live Manifest", edit the "app|resources-tree" manifest. Modify one of the component's kind, namespace, and name. Upon reloading the web page and clicking on the newly created asset, an error message appears: "Unable to load data: argocd-secret not found as part of application myapp." However, the resource's description is still transmitted to the browser, as seen in this URL format: ``` https://127.0.0.1:8081/api/v1/applications/myapp/resource?name=argocd-secret&appNamespace=argocd&namespace=argocd&resourceName=argocd-secret&version=v1&kind=Secret&group= ``` This situation results in information leakage. ### Impact This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance.
- BIT-argo-cd-2024-31989ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache2024-05-29vendor · osvUS
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.
- GO-2024-2877ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd2024-06-05vendor · osvUS
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202405-4040cnnvd
- EUVD-2024-1545enisa_euvd
- BDU:2024-05574fstec_bdu
- GHSA-9766-5277-j5hrenisa_euvd
- BIT-argo-cd-2024-31989osv
- GHSA-9766-5277-j5hrosv
- GO-2024-2877osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (28)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-31989/cnnvd
- https://github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1dcnnvd
- https://github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678cnnvd
- https://github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6ccnnvd
- https://github.com/argoproj/argo-cd/commit/53570cbd143bced49d4376d6e31bd9c7bd2659ffcnnvd
- https://github.com/argoproj/argo-cd/commit/6ef7b62a0f67e74b4aac2aee31c98ae49dd95d12cnnvd
- https://github.com/argoproj/argo-cd/commit/9552034a80070a93a161bfa330359585f3b85f07cnnvd
- https://github.com/argoproj/argo-cd/commit/bdd889d43969ba738ddd15e1f674d27964048994cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan